PT-2026-103699

CVE-2026-81739

Published

2026-10-01

Updated

2026-10-01

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Paytm Payment Gateway WordPress plugin versions prior to 2.8.9

Description Insufficient sanitization and escaping of data stored from payment callbacks allows unauthenticated users to store malicious scripts. These scripts execute within the session of a store administrator when viewed on an admin page. This issue occurs when the gateway is enabled without credentials, as the integrity check on the callbacks can be forged.

Recommendations Update the plugin to version 2.8.9 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Artus Kg

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers