Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-81740

Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paytm Wordpress-extensions
Products
Payment Gateway Paytm Payment Gateway
CVE-2026-81739

Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Paytm Wordpress-extensions
Products
Payment Gateway Paytm Payment Gateway
CVE-2026-81809

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Paytm Wordpress-extensions
Products
Payment Gateway Paytm Payment Gateway