Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: AyeCode Payment forms, Buy now buttons, and Invoicing System | GetPaid 2.8.63 Clear all filters
TI-2026-85113 CVE-2026-119749 · GHSA-mxp8-89wv-42r2

Negative quantity bypasses payment in GetPaid WordPress plugin

Priority MEDIUM 44

The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public pay…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00363 Published 2026-11-04 Fixed in 2.8.63 CWE-1284
TI-2026-85112 CVE-2026-119748 · GHSA-hr58-8ppj-xwvg

Authorization bypass in GetPaid WordPress plugin exposes invoices

Priority LOW 36

The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_us…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00232 Published 2026-11-04 Fixed in 2.8.63 CWE-639
TI-2026-85111 CVE-2026-119747 · GHSA-jf75-578j-f2xq

Incorrect authorization in GetPaid WordPress plugin REST API

Priority LOW 31

The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to g…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0021 Published 2026-11-04 Fixed in 2.8.63 CWE-863