CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

EUVD-2026-91213

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin, in versions 1.8 through 2.0.5 , is vulnerable to unauthenticated payment amount manipulation . The root cause is that the plugin fails to derive the payment amount on the server, instead relying on a client-supplied field . This allows an ...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

WordPress Easy PayPal & Stripe Buy Now Button plugin 1.8-2.0.5 - Unauthenticated Payment Amount Manipulation vulnerability

Unauthenticated Payment Amount Manipulation vulnerability discovered by JunHee CHO in WordPress Plugin Easy PayPal Buy Now Button versions 1.8-2.0.5...

CVE-2026-90987: External Control of Assumed-Immutable Web Parameter

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

PT-2026-104112

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-78088: Unrestricted Upload of File with Dangerous Type

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-16586: Improper Neutralization of Special Elements used in an SQL Command

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

CVE-2026-66660

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-66660

CVE-2026-66660 describes an unauthenticated Broken Access Control vulnerability in the WordPress plugin “Contact Form 7 – PayPal & Stripe Add-on” (versions

EUVD-2026-57898

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-66660: Missing Authorization

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.5.1...

CVE-2026-17016 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully...

PT-2026-69357

Name of the Vulnerable Software and Affected Versions Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin versions prior to 3.1.1 Description The plugin fails to verify if the PayPal account that received a payment matches the merchant's configured account before marking an...

CVE-2026-17012: Improper Access Control

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...