Vulnerability details
CVE-2026-81739
Paytm Payment Gateway
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
CVSS 3.1
7.5High
Official description
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | Paytm Payment Gateway | v < 2.8.9 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/f77f3f04-cb98-4687-9080-dd0c99a7e926/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-01
- Last updated
- 2026-10-01
- State
- Published
- Assigner (CNA)
- WPScan
Exploit prediction (EPSS)
0.21%
Probability of exploitation in 30 days
12.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')