Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

579 results · page 3 of 12

Sep 28, 2026The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order owneCVE-2026-92996 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
Affected
up to 4.13.0
What to do
Affects up to 4.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 28, 2026The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unautheCVE-2026-89411 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
Fixed in
4.6.26
What to do
Update the plugin to 4.6.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2026Online Scheduling and Appointment Booking System: Does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff memberCVE-2026-86839 · WordPress plugins & themes · reported by WPScanLow 3.8
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.
Product
Online Scheduling and Appointment Booking System
Fixed in
28.3
What to do
Update Online Scheduling and Appointment Booking System to 28.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 25, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Reflected Cross-Site ScriptingCVE-2026-88996 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context.
Product
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2026WPForms: Does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on itCVE-2026-74991 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.
Product
WPForms
Fixed in
2.0.2
What to do
Update WPForms to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paytium: Mollie payment forms & donations: Privilege EscalationCVE-2026-18467 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address.
Product
Paytium: Mollie payment forms & donations
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update Paytium: Mollie payment forms & donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 23, 2026Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.CVE-2026-95527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
Affected
up to 6.2.4
What to do
Affects up to 6.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.CVE-2026-94179 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.CVE-2026-93620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
Affected
up to 8.2.5
What to do
Affects up to 8.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026SUMIT Payment Gateway for WooCommerce: Does not verify with the payment provider that a payment notification is genuine before marking the corresponding orderCVE-2026-84091 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
Product
SUMIT Payment Gateway for WooCommerce
Fixed in
4.0.0
What to do
Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paymob for WooCommerce: Does not verify the request signature on one branch of its payment webhookCVE-2026-87978 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
Product
Paymob for WooCommerce
Fixed in
4.1.14
What to do
Update Paymob for WooCommerce to 4.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Premium Packages: Does not verify PayPal's webhook signature before processing payment and subscription notificationsCVE-2026-93511 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
Product
Premium Packages
Fixed in
7.2.1
What to do
Update Premium Packages to 7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paid Membership Subscriptions: Does not bind one of its unauthenticated payment actions to the requesting userCVE-2026-90951 · WordPress plugins & themes · reported by WPScanLow 3.7
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.
Product
Paid Membership Subscriptions
Fixed in
3.1.0
What to do
Update Paid Membership Subscriptions to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paymob for WooCommerce: Does not perform a capability check on several admin AJAX actions that manage its payment-gateway configurationCVE-2026-87981 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
Product
Paymob for WooCommerce
Fixed in
4.1.14
What to do
Update Paymob for WooCommerce to 4.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paymob for WooCommerce: Does not verify the request signature on the card-token branch of its payment webhookCVE-2026-87979 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
Product
Paymob for WooCommerce
Fixed in
4.1.14
What to do
Update Paymob for WooCommerce to 4.1.14 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Payment Plugins for PayPal WooCommerce: Does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completedCVE-2026-80342 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own.
Product
Payment Plugins for PayPal WooCommerce
Fixed in
2.0.27
What to do
Update Payment Plugins for PayPal WooCommerce to 2.0.27 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Better Payment: Does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway chargeCVE-2026-77765 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item.
Product
Better Payment
Fixed in
2.3.4
What to do
Update Better Payment to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026jet-form-builder-stripe-gateway: Does not sanitise and escape a payment token before using it in a SQL statementCVE-2022-4997 · WordPress plugins & themes · reported by WPScanHigh 8.6
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
Product
jet-form-builder-stripe-gateway
Fixed in
1.1.0
What to do
Update jet-form-builder-stripe-gateway to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026Handily: Unauthorized payment settings modificationCVE-2025-14487 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
Product
Handily
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Handily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 21, 2026Payment Gateway for PayPal on WooCommerce: Does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an oCVE-2026-92400 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
Product
Payment Gateway for PayPal on WooCommerce
Fixed in
9.2.1
What to do
Update Payment Gateway for PayPal on WooCommerce to 9.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Payment Gateway of Stripe for WooCommerce: Improper Verification of Cryptographic SignatureCVE-2026-9832 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing sec
Product
Payment Gateway of Stripe for WooCommerce
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Payment Gateway of Stripe for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit: Does not verify the authenticity of its PIX payment webhook before updating an order's statusCVE-2026-92430 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
Product
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
Fixed in
5.4.7
What to do
Update Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit to 5.4.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-92229 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.2
What to do
Affects up to 1.57.2. Update The Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026WP Easy Pay – Payment and Donation form Builder for Square: Authorization bypassCVE-2026-12739 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary posts, pages, and custom post types (bypassing the trash via force deletion) or change any published post to draft status.
Product
WP Easy Pay – Payment and Donation form Builder for Square
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update WP Easy Pay – Payment and Donation form Builder for Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026RestroPress: Does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifierCVE-2026-85009 · WordPress plugins & themes · reported by WPScanMedium 6.5
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Product
RestroPress
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Robokassa payment gateway for Woocommerce: Does not verify the authenticity of incoming payment notificationsCVE-2026-91017 · WordPress plugins & themes · reported by WPScanLow 3.7
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
Product
Robokassa payment gateway for Woocommerce
Fixed in
1.8.9
What to do
Update Robokassa payment gateway for Woocommerce to 1.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Event Booking Manager for WooCommerce: Does not restrict who can view its stored payment gateway configurationCVE-2026-91019 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.
Product
Event Booking Manager for WooCommerce
Fixed in
5.6.0
What to do
Update Event Booking Manager for WooCommerce to 5.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Autopay: Does not enforce the signature on one of its payment callbacksCVE-2026-90923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
Product
Autopay
Fixed in
5.0.1
What to do
Update Autopay to 5.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Paid Membership Subscriptions: Does not verify that the amount and currency reported by the payment provider match the pending payment before completing itCVE-2026-90922 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.
Product
Paid Membership Subscriptions
Fixed in
3.0.9
What to do
Update Paid Membership Subscriptions to 3.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 16, 2026Eventin: Does not verify that a completed payment corresponds to the order it is applied toCVE-2026-84906 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
Product
Eventin
Fixed in
4.1.24
What to do
Update Eventin to 4.1.24 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026Quads Ads Manager for Google AdSense: Does not verify payment completion with the configured payment gateway before marking an ad-selling orderCVE-2026-89050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment.
Product
Quads Ads Manager for Google AdSense
Fixed in
3.0.5
What to do
Update Quads Ads Manager for Google AdSense to 3.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated userCVE-2026-81648 · WordPress plugins & themes · reported by WPScanCritical 10
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 13, 2026Simple Membership: Does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment buttonCVE-2026-88764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
Product
Simple Membership
Fixed in
4.7.8
What to do
Update Simple Membership to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Rox Appointment Booking: Does not verify the order total or the selected payment method against its own server-side pricingCVE-2026-87892 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
Product
Rox Appointment Booking
Fixed in
1.2.0
What to do
Update Rox Appointment Booking to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2026Booking for Appointments and Events Calendar: Does not verify that a payment was actually taken before recording a bookingCVE-2026-77689 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.
Product
Booking for Appointments and Events Calendar
Fixed in
9.8.1
What to do
Update Booking for Appointments and Events Calendar to 9.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.CVE-2026-62111 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.CVE-2026-27378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2026The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to CVE-2026-86809 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.
Fixed in
2.8.2
What to do
Update the plugin to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before aCVE-2026-82215 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauCVE-2026-82213 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Sep 10, 2026Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.CVE-2026-78536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026zipMoney(Zip Co) Payments Plugin for WooCommerce: Does not perform any authorisation checks on one of its front-end request handlersCVE-2026-78361 · WordPress plugins & themes · reported by WPScanCritical 9.1
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Product
zipMoney(Zip Co) Payments Plugin for WooCommerce
Fixed in
2.4.0
What to do
Update zipMoney(Zip Co) Payments Plugin for WooCommerce to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WP Express Checkout: Does not verify server-side that a payment was actually completed before marking an orderCVE-2026-83537 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.
Product
WP Express Checkout
Fixed in
2.5.0
What to do
Update WP Express Checkout to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Payment Plugins for PayPal WooCommerce: Does not verify that a stored payment method belongs to the user attaching itCVE-2026-80341 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.
Product
Payment Plugins for PayPal WooCommerce
Fixed in
2.0.26
What to do
Update Payment Plugins for PayPal WooCommerce to 2.0.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Payment Plugins for PayPal WooCommerce: Does not validate the order key before adding order data to the JavaScript configuration it outputs on the front endCVE-2026-80340 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.
Product
Payment Plugins for PayPal WooCommerce
Fixed in
2.0.26
What to do
Update Payment Plugins for PayPal WooCommerce to 2.0.26 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026Payment Plugins for Stripe WooCommerce: Does not validate the order key before adding order data to the JavaScript configuration it outputs on the front endCVE-2026-80339 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.
Product
Payment Plugins for Stripe WooCommerce
Fixed in
4.0.12
What to do
Update Payment Plugins for Stripe WooCommerce to 4.0.12 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WP Travel: Does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlersCVE-2026-18042 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
Product
WP Travel
Fixed in
12.0.2
What to do
Update WP Travel to 12.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Accept Stripe Payments: Does not verify that the product fulfilledCVE-2026-81424 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing unauthenticated attackers who complete a genuine payment to obtain fulfilment for a different, equal- or lower-priced product than the one they paid for.
Product
Accept Stripe Payments
Fixed in
2.1.4
What to do
Update Accept Stripe Payments to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Accept Stripe Payments: Does not validate a user-supplied URL before using it in a redirectCVE-2026-81423 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.
Product
Accept Stripe Payments
Fixed in
2.1.4
What to do
Update Accept Stripe Payments to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz: Stored Cross-Site ScriptingCVE-2026-18406 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz
Affected
up to 2.12.2
What to do
Affects up to 2.12.2. Update SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.