Vulnerabilities

TI-2026-82488 CVE-2026-54866 · GHSA-463m-m2xx-mfmr

Cross-site scripting in Razorpay Payment Button Elementor plugin for WordPress

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00243 Published 2026-10-29 No fix listed CWE-79

TI-2026-73439 CVE-2026-110222 · GHSA-crh7-6qx8-9v9q

Server-side request forgery in Razorpay IFSC Ruby gem via IFSC lookup

HIGH 70

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00359 Published 2026-10-13 No fix listed CWE-918

TI-2026-63364 CVE-2026-94179 · GHSA-67p8-jpwc-54vj

WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-09-23 No fix listed CWE-79

TI-2026-51999 CVE-2026-74009 · GHSA-vqvx-w44w-grjh

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

LOW 30

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00294 Published 2026-08-18 No fix listed CWE-639

TI-2026-28627 CVE-2026-39656 · GHSA-xj54-92rq-85wc

WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability

LOW 29

Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00222 Published 2026-04-08 No fix listed CWE-862

TI-2025-13059 CVE-2025-14294 · GHSA-67hm-gm63-c6j6

Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification

LOW 30

The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0041 Published 2026-02-19 No fix listed CWE-306

TI-2024-12851 CVE-2024-13827 · GHSA-557c-c52f-8p63

Cross-site scripting in Razorpay Subscription Button Elementor Plugin

LOW 27

The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and remove_query_arg() functions without appropriate escaping on th…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00329 Published 2025-03-05 No fix listed CWE-79

TI-2024-10058 CVE-2024-10850 · GHSA-w423-qh63-c937

Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting

LOW 28

The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00523 Published 2024-11-13 No fix listed CWE-79

TI-2024-10059 CVE-2024-10851 · GHSA-ffc8-3w8p-4h77

Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting

LOW 28

The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, an…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00534 Published 2024-11-13 No fix listed CWE-79

Vulnerabilities

Filters