Updated 31 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

353new WordPress flaws this week

390,080entries in the database

212 results · page 3 of 5

Apr 8, 2026iPOSpays Gateways WC: Missing AuthorizationCVE-2026-39608 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through <= 1.3.7.
Product
iPOSpays Gateways WC
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update iPOSpays Gateways WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 21, 2026MinhNhut Link Gateway: Stored Cross-Site ScriptingCVE-2026-3333 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linkgate' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MinhNhut Link Gateway
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update MinhNhut Link Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026Payment Gateway Pix For GiveWP: Missing AuthorizationCVE-2026-32425 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in linknacional Payment Gateway Pix For GiveWP payment-gateway-pix-for-givewp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Pix For GiveWP: from n/a through <= 2.2.3.
Product
Payment Gateway Pix For GiveWP
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Payment Gateway Pix For GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Checkout Gateway for IRIS: Missing AuthorizationCVE-2025-68542 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through <= 1.3.
Product
Checkout Gateway for IRIS
Affected
up to 1.3
What to do
Affects up to 1.3. Update Checkout Gateway for IRIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-67969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.
Product
UPI QR Code Payment Gateway for WooCommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 17, 2026Zarinpal Gateway for WooCommerce: Improper Access Control to Payment Status UpdateCVE-2026-2592 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.
Product
Zarinpal Gateway for WooCommerce
Affected
up to 5.0.16
What to do
Affects up to 5.0.16. Update Zarinpal Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026BlueSnap Payment Gateway for WooCommerce: Missing AuthorizationCVE-2026-0692 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` function to validate IPN requests, which trusts user-controllable headers like X-Real-IP and X-Forwarded-For to determine the client IP address. This makes it possible for unauthenticated attackers to bypass IP allowlist restrictions by spoofing a whitelisted BlueSnap IP address and send forged IPN (Instant Payment Notification) data to manipulate order statuses (mark orders as paid, failed, refunded, or on-hold) without proper authorization.
Product
BlueSnap Payment Gateway for WooCommerce
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update BlueSnap Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2026OpenPix for WooCommerce: Allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checksCVE-2025-15400 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.
Product
OpenPix for WooCommerce
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update OpenPix for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 4, 2026SIBS woocommerce payment gateway: Time-based SQL InjectionCVE-2026-1370 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedId’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
SIBS woocommerce payment gateway
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update SIBS woocommerce payment gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2026Chapa Payment Gateway Plugin for WooCommerce: Sensitive Information ExposureCVE-2025-15482 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 via 'chapa_proceed' WooCommerce API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including the merchant's Chapa secret API key.
Product
Chapa Payment Gateway Plugin for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Chapa Payment Gateway Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2026Wizit Gateway for WooCommerce: Unauthenticated Arbitrary Order CancellationCVE-2025-14843 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.3.1. This is due to a lack of authentication and authorization checks in the 'handle_checkout_redirecturl_response' function. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by sending a crafted request with a valid order ID.
Product
Wizit Gateway for WooCommerce
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Wizit Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026SumUp Payment Gateway For WooCommerce: Missing AuthorizationCVE-2026-24583 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through <= 2.7.9.
Product
SumUp Payment Gateway For WooCommerce
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update SumUp Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026onepay Payment Gateway For WooCommerce: Missing AuthorizationCVE-2025-68016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.
Product
onepay Payment Gateway For WooCommerce
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update onepay Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.
Product
Payment Gateway Authorize.Net CIM for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Peach Payments Gateway: Missing AuthorizationCVE-2025-67942 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.
Product
Peach Payments Gateway
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Peach Payments Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Payment Gateway bKash for WC: Missing AuthorizationCVE-2025-62754 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.
Product
Payment Gateway bKash for WC
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Payment Gateway bKash for WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 14, 2026Float Payment Gateway: Unauthorized modification of dataCVE-2025-15513 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to mark any WooCommerce order as failed.
Product
Float Payment Gateway
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Float Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026Aplazo Payment Gateway: Unauthorized modification of dataCVE-2025-15512 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_response() function in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to set any WooCommerce order to `pending payment` status.
Product
Aplazo Payment Gateway
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Aplazo Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026PayHere Payment Gateway Plugin for WooCommerce: Unauthorized modification of dataCVE-2025-15475 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic in the check_payhere_response function in all versions up to, and including, 2.3.9. This makes it possible for unauthenticated attackers to change the status of pending WooCommerce orders to paid/completed/on hold.
Product
PayHere Payment Gateway Plugin for WooCommerce
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update PayHere Payment Gateway Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026Netcash WooCommerce Payment Gateway: Unauthorized modification of dataCVE-2025-14880 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_return_url function in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processing/completed.
Product
Netcash WooCommerce Payment Gateway
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update Netcash WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026iPaymu Payment Gateway for WooCommerce: Missing AuthenticationCVE-2026-0656 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook request authenticity through signature verification or origin checks. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid by sending crafted POST requests to the webhook endpoint without any payment occurring, as well as enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII including names, addresses, and purchased products.
Product
iPaymu Payment Gateway for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update iPaymu Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026HBLPAY Payment Gateway for WooCommerce: Reflected Cross-Site ScriptingCVE-2025-14875 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
HBLPAY Payment Gateway for WooCommerce
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update HBLPAY Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026Piraeus Bank WooCommerce Payment Gateway: Unauthorized order status modificationCVE-2025-14460 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modification in all versions up to, and including, 3.1.4. This is due to missing authorization checks on the payment callback endpoint handler when processing the 'fail' callback from the payment gateway. This makes it possible for unauthenticated attackers to change any order's status to 'failed' via the publicly accessible WooCommerce API endpoint by providing only the order ID (MerchantReference parameter), which can be easily enumerated as order IDs are sequential integers. This can cause significant business disruption including canceled shipments, inventory issues, and loss of revenue.
Product
Piraeus Bank WooCommerce Payment Gateway
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Piraeus Bank WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2025Quran Gateway: Cross-Site Request ForgeryCVE-2025-14164 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation in the quran_gateway_options function. This makes it possible for unauthenticated attackers to modify the plugin's display settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Quran Gateway
Affected
up to 1.5
What to do
Affects up to 1.5. Update Quran Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2025Yaad Sarig Payment Gateway For WC: Missing AuthorizationCVE-2025-66131 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yaad Sarig Payment Gateway For WC: from n/a through <= 2.2.11.
Product
Yaad Sarig Payment Gateway For WC
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update Yaad Sarig Payment Gateway For WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 11, 2025Campay Woocommerce Payment Gateway: Unauthenticated Payment BypassCVE-2025-12883 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred through the payment gateway. This makes it possible for unauthenticated attackers to bypass payments and mark orders as successfully completed resulting in a loss of income.
Product
Campay Woocommerce Payment Gateway
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Campay Woocommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 9, 2025Payment Gateway for PayPal on WooCommerce: Missing AuthorizationCVE-2025-63023 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Easy Payment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway for PayPal on WooCommerce: from n/a through <= 9.0.53.
Product
Payment Gateway for PayPal on WooCommerce
Affected
up to 9.0.53
What to do
Affects up to 9.0.53. Update Payment Gateway for PayPal on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WooCommerce Payment Gateway - Paysera: Missing AuthorizationCVE-2025-63015 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.
Product
WooCommerce Payment Gateway - Paysera
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update WooCommerce Payment Gateway - Paysera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Eupago Gateway For Woocommerce: Missing AuthorizationCVE-2025-62870 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Eupago Eupago Gateway For Woocommerce eupago-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eupago Gateway For Woocommerce: from n/a through <= 4.7.1.
Product
Eupago Gateway For Woocommerce
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update Eupago Gateway For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2025Cryptocurrency Payment Gateway for WooCommerce: Unauthorized modification of dataCVE-2025-12392 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_optin_optout' function in all versions up to, and including, 2.0.25. This makes it possible for unauthenticated attackers to opt in and out of tracking.
Product
Cryptocurrency Payment Gateway for WooCommerce
Affected
up to 2.0.25
What to do
Affects up to 2.0.25. Update Cryptocurrency Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 6, 2025HieCOR Payment Gateway: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway allows SQL Injection.This issue affects HieCOR Payment Gateway Plugin: from n/a through <= 1.5.11.
Product
HieCOR Payment Gateway
Affected
up to 1.5.11
What to do
Affects up to 1.5.11. Update HieCOR Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 4, 2025Crypto Payment Gateway with Payeer for WooCommerce: Payment bypassCVE-2025-11890 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Crypto Payment Gateway with Payeer for WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a payments status through server-side validation though the /wc-api/bp-payeer-gateway-callback endpoint. This makes it possible for unauthenticated attackers to update unpaid order statuses to paid resulting in a loss of revenue.
Product
Crypto Payment Gateway with Payeer for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Crypto Payment Gateway with Payeer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 24, 2025VNPAY Payment gateway: Reflected Cross-Site ScriptingCVE-2025-12017 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
VNPAY Payment gateway
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update VNPAY Payment gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordfence.com
Oct 22, 2025Robokassa payment gateway for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49958 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.8.6.
Product
Robokassa payment gateway for Woocommerce
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Robokassa payment gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2025Oceanpayment CreditCard Gateway: Unauthenticated and unauthorized modification of dataCVE-2025-11728 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.
Product
Oceanpayment CreditCard Gateway
Affected
up to 6.0
What to do
Affects up to 6.0. Update Oceanpayment CreditCard Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Payrexx Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-59559 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payrexx Payment Gateway for WooCommerce: from n/a through <= 3.1.5.
Product
Payrexx Payment Gateway for WooCommerce
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Payrexx Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025CardCom Payment Gateway: Missing AuthorizationCVE-2025-57976 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CardCom Payment Gateway: from n/a through <= 3.5.0.7.
Product
CardCom Payment Gateway
Affected
up to 3.5.0.7
What to do
Affects up to 3.5.0.7. Update CardCom Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025WooCommerce Payment Gateway for Saferpay: Path Traversal: '.../...//'CVE-2025-48317 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traversal.This issue affects WooCommerce Payment Gateway for Saferpay: from n/a through <= 0.4.9.
Product
WooCommerce Payment Gateway for Saferpay
Affected
up to 0.4.9
What to do
Affects up to 0.4.9. Update WooCommerce Payment Gateway for Saferpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48102 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership gourl-bitcoin-payment-gateway-paid-downloads-membership allows Stored XSS.This issue affects GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership: from n/a through <= 1.6.6.
Product
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Trust Payments Gateway for WooCommerce (JavaScript Library): Cross-Site Request Forgery (CSRF)CVE-2025-53569 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce (JavaScript Library): from n/a through <= 1.3.6.
Product
Trust Payments Gateway for WooCommerce (JavaScript Library)
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Trust Payments Gateway for WooCommerce (JavaScript Library) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025iCount Payment Gateway: Missing AuthorizationCVE-2025-53295 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.
Product
iCount Payment Gateway
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update iCount Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025CryptoCloud - Crypto Payment Gateway: Missing AuthorizationCVE-2025-48147 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through <= 2.1.2.
Product
CryptoCloud - Crypto Payment Gateway
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update CryptoCloud - Crypto Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025CoinPayments.net Payment Gateway for WooCommerce: Deserialization of Untrusted DataCVE-2025-47532 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through <= 1.0.17.
Product
CoinPayments.net Payment Gateway for WooCommerce
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update CoinPayments.net Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46486 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.7.
Product
Nomupay Payment Processing Gateway
Affected
up to 7.1.7
What to do
Affects up to 7.1.7. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Payment Gateway for Telcell: Does not validate the api_url parameter before redirecting the user to its valueCVE-2023-6786 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue
Product
Payment Gateway for Telcell
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Payment Gateway for Telcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 7, 2025Pays – WooCommerce Payment Gateway: Cross-Site Request Forgery (CSRF)CVE-2025-47648 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through <= 2.6.
Product
Pays – WooCommerce Payment Gateway
Affected
up to 2.6
What to do
Affects up to 2.6. Update Pays – WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WooCommerce TBC Credit Card Payment Gateway (Free): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in We Are De WooCommerce TBC Credit Card Payment Gateway (Free) woo-tbc-payment-gateway allows Reflected XSS.This issue affects WooCommerce TBC Credit Card Payment Gateway (Free): from n/a through <= 2.0.0.
Product
WooCommerce TBC Credit Card Payment Gateway (Free)
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WooCommerce TBC Credit Card Payment Gateway (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Nomupay Payment Processing Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Reflected XSS.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.6.
Product
Nomupay Payment Processing Gateway
Affected
up to 7.1.6
What to do
Affects up to 7.1.6. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025ABA PayWay Payment Gateway for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce aba-payway-woocommerce-payment-gateway allows Reflected XSS.This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through <= 2.1.4.
Product
ABA PayWay Payment Gateway for WooCommerce
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update ABA PayWay Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025WooCommerce – Payphone Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32523 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway wc-payphone-gateway allows Reflected XSS.This issue affects WooCommerce – Payphone Gateway: from n/a through <= 3.2.0.
Product
WooCommerce – Payphone Gateway
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update WooCommerce – Payphone Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.