Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Paytium: Mollie payment forms & donationsDonation Forms by Charitable – Donations Plugin & Fundraising Platform forAccept Donations with PayPalsmart-donationsWP Attractive Donations System - Easy Stripe & Paypal donationstotaldonationsDonation Block For PayPalRecurring PayPal Donations
Plugin · paytium
Paytium: Mollie payment forms & donations
15 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Paytium: Mollie payment forms & donations safe? The full page →
Oct 24, 2026Paytium: Deserialization of Untrusted DataCVE-2026-114196 · affects up to 5.0.5 · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
Sep 23, 2026Paytium: Mollie payment forms & donations: Privilege EscalationCVE-2026-18467 · affects up to 5.0.3 · reported by WordfenceCritical 9.8
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.CVE-2026-56030 · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.
Jan 24, 2025Paytium: Generation of Error Message Containing Sensitive InformationCVE-2025-24552 · affects up to 4.4.11 · reported by PatchstackMedium 5.3
Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue affects Paytium: from n/a through <= 4.4.11.
Dec 31, 2024Paytium: Missing AuthorizationCVE-2024-51667 · affects up to 4.4.10 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized data modificationCVE-2023-7294 · affects up to 4.3.7 · reported by WordfenceHigh 7.1
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the create_mollie_profile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to create a mollie payment profile.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized access of dataCVE-2023-7293 · affects up to 4.3.7 · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_mollie_account_details function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to verify the existence of a mollie account.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized notification dismissalCVE-2023-7292 · affects up to 4.3.7 · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized notification dismissal due to a missing capability check on the paytium_notice_dismiss function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to dismiss admin notices.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized modification of dataCVE-2023-7291 · affects up to 4.3.7 · reported by WordfenceHigh 7.1
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_mollie_account function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to set up a mollie account.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized access of dataCVE-2023-7290 · affects up to 4.3.7 · reported by WordfenceMedium 4.3
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_for_verified_profiles function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to check profile statuses.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized API key updateCVE-2023-7289 · affects up to 4.3.7 · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytium_sw_save_api_keys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin API keys.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized data modificationCVE-2023-7288 · affects up to 4.3.7 · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_profile_preference function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to change plugin settings.
Oct 16, 2024Paytium: Mollie payment forms & donations: Unauthorized subscription cancellationCVE-2023-7287 · affects up to 4.3.7 · reported by WordfenceMedium 5.4
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing capability check on the pt_cancel_subscription function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to cancel a subscription to the plugin.
Mar 13, 2024Paytium: Mollie payment forms & donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-25099 · affects up to 4.4.2 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations allows Stored XSS.This issue affects Paytium: Mollie payment forms & donations: from n/a through 4.4.2.
Dec 26, 2022Paytium: Mollie payment forms & donations: Does not sanitise and escape some of its settingsCVE-2022-4042 · fixed in 4.3.7 · reported by WPScanMedium 4.8
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.