sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total8
Critical0
High2
Medium6
Reset
Showing 1-8 of 8 records
Threat Entry Updated 2026-08-26

Quick Paypal Payments - Broken Access Control (CVE-2026-17008)

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.

PLUGIN Quick Paypal Payments

CVE-2026-17008

MEDIUM CVSS 5.3 2026-08-12
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Quick Paypal Payments - Cross-Site Request Forgery (CSRF) (CVE-2022-4974)

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

PLUGIN Quick Paypal Payments

CVE-2022-4974

MEDIUM CVSS 6.3 2024-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Quick Paypal Payments - Cross-Site Scripting (XSS) (CVE-2023-1554)

The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Quick Paypal Payments

CVE-2023-1554

MEDIUM CVSS 4.8 2023-05-02
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.