Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Stripe Payment Forms by WP Full Pay 8.5.1 Clear all filters
TI-2026-54178 CVE-2026-77789 · GHSA-wq46-399w-9f66

Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR

Priority LOW 20

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-08-26 Fixed in 8.5.1 CWE-639
TI-2026-54152 CVE-2026-77758 · GHSA-7q4v-225q-qmcp

Information disclosure in Stripe Payment Forms by WP Full Pay

Priority LOW 30

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to r…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-08-26 Fixed in 8.5.1 CWE-200