EUVD-2024-52426

Malicious code in bioql PyPI...

EUVD-2025-19376

Malicious code in bioql PyPI...

CVE-2025-6688

The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...

CVE-2025-6688 Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin

The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...

CVE-2025-6688 Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin

The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...

CVE-2025-6688

CVE-2025-6688 (Simple Payment, WordPress) : Affects WordPress Simple Payment plugin versions 1.3.6–2.3.8. Root cause: login flow does not properly verify a user’s identity before using create_user(), enabling an unauthenticated attacker to log in as an administrator. Impact: Authentication bypass...

WordPress plugin Simple Payment 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Simple Payment plugin 1.3.6-2.3.8 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin Simple Payment versions 1.3.6-2.3.8...

CVE-2024-54303

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through = 2.3.8...

CVE-2024-54303

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through = 2.3.8...

CVE-2024-54303 WordPress Simple Payment plugin <= 2.3.7 - Refleceted Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ido Kobelkowsky / yalla ya! Simple Payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.3.7...

CVE-2024-54303 WordPress Simple Payment plugin <= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through = 2.3.8...

CVE-2024-54303

CVE-2024-54303 is a reflected XSS in the Simple Payment WordPress plugin (versions &lt;= 2.3.7) where improper neutralization of input during Web Page Generation allows injection of script output. The CVSS 3.1 base score is 7.1 (HIGH), with attack vector NETWORK, no privileges required, user inte...

PT-2024-36184 · Unknown · Yalla Ya! Simple Payment

Name of the Vulnerable Software and Affected Versions: yalla ya! Simple Payment versions 2.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS, where an attacker can...

WordPress plugin Simple Payment 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Simple Payment plugin <= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Simple Payment versions = 2.3.8...

CVE-2022-2565

The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins...

Automattic: Stored XSS in Jetpack's Simple Payment Module by Contributors / Authors

Jetpack's implementation of the Simple Payment Module is as follows: A custom post type is registered for each product. When an admin creates a product, a post is internally created and information about the product, such as the price is then stored as post meta information. After the post has be...