CVE-2026-81739

Name of the Vulnerable Software and Affected Versions Paytm Payment Gateway WordPress plugin versions prior to 2.8.9

Description Insufficient sanitization and escaping of data stored from payment callbacks allows unauthenticated users to store malicious scripts. These scripts execute within the session of a store administrator when viewed on an admin page. This issue occurs when the gateway is enabled without credentials, as the integrity check on the callbacks can be forged.

Recommendations Update the plugin to version 2.8.9 or later.