Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · paymob-for-woocommerce
paymob-for-woocommerce
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 23, 2026Paymob for WooCommerce: Does not verify the request signature on one branch of its payment webhookCVE-2026-87978 · fixed in 4.1.14 · reported by WPScanMedium 5.3
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
Sep 23, 2026Paymob for WooCommerce: Does not perform a capability check on several admin AJAX actions that manage its payment-gateway configurationCVE-2026-87981 · fixed in 4.1.14 · reported by WPScanMedium 4.7
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
Sep 23, 2026Paymob for WooCommerce: Does not verify the request signature on the card-token branch of its payment webhookCVE-2026-87979 · fixed in 4.1.14 · reported by WPScanMedium 5.3
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.CVE-2026-66611 · affects up to 4.1.10 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
Aug 14, 2026Paymob for WooCommerce: Does not properly sanitise a client-supplied identifier before using it in a SQL query within its publicCVE-2026-15205 · fixed in 4.1.9 · reported by WPScanHigh 8.6
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.
Jun 26, 2026Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.CVE-2026-56025 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.