Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,668 results · page 18 of 54
Feb 20, 2026Mollie Payments for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce allows Reflected XSS.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.1.1.
- Product
- Mollie Payments for WooCommerce
- Affected
- up to 8.1.1
- What to do
- Affects up to 8.1.1. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Travelpayouts: Missing AuthorizationCVE-2025-68042 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.
- Product
- Travelpayouts
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Travelpayouts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-67969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.
- Product
- UPI QR Code Payment Gateway for WooCommerce
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CediPay is a crypto-to-fiat app for the Ghanaian market.CVE-2026-26063 · Other software · xpertforextradeinc · reported by GitHubHigh 8.8
CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.
- Product
- CediPay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Razorpay for WooCommerce: Unauthorized modification of dataCVE-2025-14294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permission callback always returning true, providing no actual authentication. This makes it possible for unauthenticated attackers to modify the billing and shipping contact information (email and phone) of any WooCommerce order by knowing or guessing the order ID.
- Product
- Razorpay for WooCommerce
- Affected
- up to 4.7.8
- What to do
- Affects up to 4.7.8. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Stored Cross-Site ScriptingCVE-2025-13732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 's2Eot' shortcode in all versions up to, and including, 251005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
- Affected
- up to 251005
- What to do
- Affects up to 251005. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26281 · Other software · InvoicePlane · reported by GitHubMedium 4.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-26270 · Other software · InvoicePlane · reported by GitHubMedium 5.4
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane (latest version) that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into the "Identifier Format" field. This script executes when any user views the invoice list or the main dashboard. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25596 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject malicious JavaScript that executes when any administrator views an invoice containing a product with the malicious unit. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25595 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any administrator views the affected invoice or visits the dashboard. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25594 · Other software · InvoicePlane · reported by GitHubMedium 4.8
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The `family_name` value is rendered without HTML encoding inside the family dropdown on the product form. When an administrator creates a family with a malicious name, the payload executes in the browser of any administrator who visits the product form. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-25548 · Other software · InvoicePlane · reported by GitHubCritical 9.1
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbitrary system commands on the server by manipulating the `public_invoice_template` setting to include poisoned log files containing PHP code. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24745 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24744 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24743 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function allows the application to upload svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-24746 · Other software · InvoicePlane · reported by GitHubMedium 5.7
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quote_number parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.CVE-2026-23491 · Other software · InvoicePlane · reported by GitHubCritical 9.3
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the input filename. This leads to the disclosure of sensitive information, including configuration files with database credentials. Version 1.6.4 fixes the issue.
- Product
- InvoicePlane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator toCVE-2025-14340 · Other software · Payara Platform · reported by 769c9ae7-73c3-4e47-ae19-903170fc3eb8High 7.3
Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
- Product
- Payara Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Payment bypassCVE-2025-14444 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 6.0.6.9
- What to do
- Affects up to 6.0.6.9. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2026Zarinpal Gateway for WooCommerce: Improper Access Control to Payment Status UpdateCVE-2026-2592 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.
- Product
- Zarinpal Gateway for WooCommerce
- Affected
- up to 5.0.16
- What to do
- Affects up to 5.0.16. Update Zarinpal Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-2002 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin allows admins to give form management permissions to lower level users, which could make this exploitable by users such as subscribers.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.50.2
- What to do
- Affects up to 1.50.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 14, 2026Payment Page | Payment Form for Stripe: Stored Cross-Site ScriptingCVE-2026-0751 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Payment Page | Payment Form for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricing_plan_select_text_font_family' parameter in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Payment Page | Payment Form for Stripe
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Payment Page | Payment Form for Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2026BlueSnap Payment Gateway for WooCommerce: Missing AuthorizationCVE-2026-0692 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization.
- Product
- BlueSnap Payment Gateway for WooCommerce
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update BlueSnap Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2026An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpointCVE-2025-70886 · Other software · Halo · reported by MITREHigh 7.5
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026OpenPix for WooCommerce: Allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checksCVE-2025-15400 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.
- Product
- OpenPix for WooCommerce
- Affected
- up to 2.13.3
- What to do
- Affects up to 2.13.3. Update OpenPix for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 9, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc.CVE-2025-7799 · Other software · Zirve Information Technologies Inc. · reported by iletisim@usom.gov.trHigh 8.6
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS. This issue affects e-Taxpayer Accounting Website: through 07082025.
- Product
- e-Taxpayer Accounting Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 6, 2026Payload is a free and open source headless content management system.CVE-2026-25574 · Other software · payloadcms · reported by GitHubMedium 5.4
Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Payload is a free and open source headless content management system.CVE-2026-25544 · Other software · payloadcms · reported by GitHubCritical 9.8
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt()CVE-2026-23059 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb. However, the iocb member is defined as a fixed-size 64-byte array within struct purex_item. If the reported frame_size exceeds 64 bytes, subsequent memcpy calls will overflow the iocb member boundary. While extra memory might be allocated, this cross-member write is unsafe and triggers warnings under CONFIG_FORTIFY_SOURCE. Fix this by capping total_bytes to the size of the iocb member (64 bytes) before allocation and copying. This ensures all copies remain within the bounds of the destination structure member.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 4, 2026SIBS woocommerce payment gateway: Time-based SQL InjectionCVE-2026-1370 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedId’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- SIBS woocommerce payment gateway
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update SIBS woocommerce payment gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 4, 2026Chapa Payment Gateway Plugin for WooCommerce: Sensitive Information ExposureCVE-2025-15482 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 via 'chapa_proceed' WooCommerce API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including the merchant's Chapa secret API key.
- Product
- Chapa Payment Gateway Plugin for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Chapa Payment Gateway Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 4, 2026Xendit Payment: Unauthorized order status manipulationCVE-2025-14461 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint (`wc_xendit_callback`) that processes payment callbacks without any authentication or cryptographic verification that the requests originate from Xendit's payment gateway. This makes it possible for unauthenticated attackers to mark any WooCommerce order as paid by sending a crafted POST request to the callback URL with a JSON body containing an `external_id` matching the order ID pattern and a `status` of 'PAID' or 'SETTLED', granted they can enumerate order IDs (which are sequential integers). This leads to orders being fraudulently marked as completed without any actual payment, resulting in financial loss and inventory depletion.
- Product
- Xendit Payment
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update Xendit Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through thCVE-2020-37085 · Other software · SunnySideSoft · reported by VulnCheckHigh 8.7
VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by sending oversized string payloads through the Thrift protocol. Attackers can exploit the vulnerability by sending a long string to the send_say() method, causing the server to become unresponsive.
- Product
- VirtualTablet Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsunnysidesoft.comexploit-db.com
Feb 3, 2026CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payCVE-2020-37071 · Other software · CraftCMS · reported by VulnCheckCritical 9.3
CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download functionality with a specially crafted request.
- Product
- CraftCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comgitlab.com
Feb 1, 2026Multiple payment terminal versions contain non-persistent cross-site scripting vulnerabilities in billing and payment information input fields.CVE-2021-47885 · Other software · CriticalGears · reported by VulnCheckMedium 5.1
Multiple payment terminal versions contain non-persistent cross-site scripting vulnerabilities in billing and payment information input fields. Attackers can inject malicious script code through vulnerable parameters to manipulate client-side requests and potentially execute session hijacking or phishing attacks.
- Product
- PayPal PRO Payment Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcriticalgears.comcriticalgears.com
Jan 28, 2026Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This CVE-2026-0750 · Websites & servers · reported by mlhess@drupal.orgHigh 8.7
Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd7es.tag1.comherodevs.com
Jan 28, 2026Rupantorpay: Unauthorized modification of dataCVE-2025-15511 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to modify WooCommerce order statuses by sending crafted requests to the WooCommerce API endpoint.
- Product
- Rupantorpay
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Rupantorpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 27, 2026Link Invoice Payment for WooCommerce: Unauthorized modification of dataCVE-2025-14971 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration.
- Product
- Link Invoice Payment for WooCommerce
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update Link Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Penci Pay Writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24601 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stored XSS.This issue affects Penci Pay Writer: from n/a through <= 1.5.
- Product
- Penci Pay Writer
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Penci Pay Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026SumUp Payment Gateway For WooCommerce: Missing AuthorizationCVE-2026-24583 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through <= 2.7.9.
- Product
- SumUp Payment Gateway For WooCommerce
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update SumUp Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in CVE-2026-0535 · Other software · Autodesk · reported by psirt@autodesk.comHigh 8.1
A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.appstreaming.autodesk.comdl.appstreaming.autodesk.com
Jan 22, 2026A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the AutCVE-2026-0534 · Other software · Autodesk · reported by psirt@autodesk.comHigh 8.1
A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.appstreaming.autodesk.comdl.appstreaming.autodesk.com
Jan 22, 2026A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-siteCVE-2026-0533 · Other software · Autodesk · reported by psirt@autodesk.comHigh 8.1
A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.appstreaming.autodesk.comdl.appstreaming.autodesk.com
Jan 22, 2026JNews - Pay Writer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68905 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows PHP Local File Inclusion.This issue affects JNews - Pay Writer: from n/a through <= 11.0.0.
- Product
- JNews - Pay Writer
- Affected
- up to 11.0.0
- What to do
- Affects up to 11.0.0. Update JNews - Pay Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026onepay Payment Gateway For WooCommerce: Missing AuthorizationCVE-2025-68016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.
- Product
- onepay Payment Gateway For WooCommerce
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update onepay Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.
- Product
- Payment Gateway Authorize.Net CIM for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Peach Payments Gateway: Missing AuthorizationCVE-2025-67942 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.
- Product
- Peach Payments Gateway
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Peach Payments Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway bKash for WC: Missing AuthorizationCVE-2025-62754 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.
- Product
- Payment Gateway bKash for WC
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Payment Gateway bKash for WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 19, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net): Unauthorized modification of dataCVE-2025-14978 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to, and including, 1.119.8. This makes it possible for unauthenticated attackers to modify the status of arbitrary WooCommerce orders.
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net)
- Affected
- up to 1.119.8
- What to do
- Affects up to 1.119.8. Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 19, 2026A vulnerability was detected in technical-laohu mpay up to 1.2.4.CVE-2026-1153 · Other software · technical-laohu · reported by VulDBLow 2.1
A vulnerability was detected in technical-laohu mpay up to 1.2.4. This affects an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used.
- Product
- mpay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.