Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-81740

Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paytm Wordpress-extensions
Products
Payment Gateway Paytm Payment Gateway
CVE-2026-81739

Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Paytm Wordpress-extensions
Products
Payment Gateway Paytm Payment Gateway
CVE-2026-81809

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Paytm Wordpress-extensions
Products
Payment Gateway Paytm Payment Gateway
CVE-2022-45805

WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Injection.This issue affects Paytm Payment Gateway: from n/a through 2.7.3.

CVSS 3.1 · 8.2 High EPSS 2.3% KEV · Not listed
Vendors
Paytm
Products
Payment Gateway
CVE-2022-45362

WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.

CVSS 3.1 · 7.2 High EPSS 42.0% KEV · Not listed
Vendors
Paytm
Products
Payment Gateway