CVE-2026-73398

The WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 has a broken authentication flaw exploitable by unauthenticated remote attackers, allowing unauthorized actions with low integrity and availability impact. CVSS 6.5 (Medium). Patchstack advisory linked; no exploit code or specifi...

CVE-2026-73398: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-6939: Improper Neutralization of Input During Web Page Generation

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approvalcode' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-9028: Missing Authorization

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers t...

CVE-2026-9027: Improper Verification of Cryptographic Signature

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The corvuspaysuccesshandler function registers the REST endpoint POST /wp-json/corvuspay/success/ with...

CVE-2026-56029: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway = 2.7.4 versions...

CVE-2026-1370: Improper Neutralization of Special Elements used in an SQL Command

The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedId’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-14880: Missing Authorization

The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handlereturnurl function in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to mark any WooCommer...

CVE-2025-14460: Missing Authorization

The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modification in all versions up to, and including, 3.1.4. This is due to missing authorization checks on the payment callback endpoint handler when processing the 'fail' callback from the...

CVE-2025-12883: Authorization Bypass Through User-Controlled Key

The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred through the payment gateway. This makes it possible for...

CVE-2025-63015: Missing Authorization

Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through = 3.10.0...

EUVD-2025-13744

Malicious code in bioql PyPI...

CVE-2025-48317: Path Traversal: '.../...//'

Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traversal.This issue affects WooCommerce Payment Gateway for Saferpay: from n/a through = 0.4.9...

CVE-2025-47648

Cross-Site Request Forgery CSRF vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through = 2.6...

CVE-2025-47648

Cross-Site Request Forgery CSRF vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through = 2.6...

CVE-2025-47648 WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through = 2.6...

CVE-2025-47648 WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through = 2.6...

CVE-2025-47648

CVE-2025-47648 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Pays – WooCommerce Payment Gateway plugin for WordPress, affecting versions n/a through 2.6. The issue enables a Stored XSS scenario as noted in multiple sources. Public technical details in connected documents conf...

PT-2025-20205 · Woocommerce · Pays – Woocommerce Payment Gateway

Name of the Vulnerable Software and Affected Versions: Pays – WooCommerce Payment Gateway versions n/a through 2.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 2.6, update to a version that fixes the CS...

CVE-2025-47648: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through = 2.6...