Read the docs

paymentplugins

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

paymentplugins records in CISA KEV

No paymentplugins vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Stripe For Woocommerce 1 record LOW

Records

6 records

TI-2025-11821 CVE-2025-12903 · GHSA-vjf2-9278-jmj7

Authorization bypass in paymentplugins Payment Plugins Braintree For WooCommerce

Priority LOW 39

The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaulted_nonce REST API endpoint in all versions up to,…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0047 Published 2025-11-12 No fix listed CWE-639
TI-2026-28614 CVE-2026-39643 · GHSA-9355-239h-5rwf

WordPress Payment Plugins for PayPal WooCommerce plugin <= 2.0.13 - Broken Access Control vulnerability

Priority LOW 29

Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00222 Published 2026-04-08 No fix listed CWE-862
TI-2026-70164 CVE-2026-89100 · GHSA-775r-g6cx-c684

Reflected XSS in Payment Plugins for Stripe WooCommerce

Priority LOW 27

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitiza…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00215 Published 2026-10-10 No fix listed CWE-79
TI-2021-16714 CVE-2021-39347 · GHSA-jv5v-gch6-hq4m

Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking

Priority LOW 21

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure th…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0067 Published 2021-10-04 No fix listed CWE-862
Open these records in search →