SecAlerts
p

paypal

Security Risk Profile

32
/100
low

Security Risk Score

Comprehensive risk assessment based on 43 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from January 13, 2006 to present

43
Total CVEs
5
Critical+High
1
Exploited
5
Unpatched

Threat Assessment

Avg CVSS
5.9
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
5
Critical/High
Risk Level
32/100
low
⚠️ 1 Active Exploits📈 1 in Last 30 Days

Severity Distribution

Critical
1
High
4
Medium
32
Low
1

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
1

Age Distribution

Common Weaknesses (CWE)

1
Input Validation
12
2
XSS
10
3
CSRF
2
4
Infoleak
1
5
SQL Injection
1

Most Affected Products

1. Apache Axis25
2. Paypal PayPal6
3. IBM Data Virtualization on Cloud Pak for Data6
4. IBM Watson Query on Cloud Pak for Data6
5. composer/paypal/merchant-sdk-php4

Recent Vulnerabilities

See more →
CVE-2026-76058
CVSS 5.3medium

PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action

Oct 28, 2026🔧 No Patch
CVE-2026-80340
CVSS 5.3medium

Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay

Sep 9, 2026🔧 No Patch
CVE-2026-16990
CVSS 5.3medium

Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation

Aug 12, 2026🔧 No Patch
CVE-2026-13399
CVSS 7.5high

Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order

Aug 6, 2026🔧 No Patch
CVE-2026-15502
CVSS 5.3medium

AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection

Jul 12, 2026🔧 No Patch
https://reddit.com/r/cybersecurity/comments/1u9d9kn/authenticating_a_paypal_notification_is_not_the/
unknown

Authenticating a PayPal notification is not the same as trusting what it says (CVE-2026-9189)

Jun 18, 2026🔧 No Patch
CVE-2025-12752
CVSS 5.3medium

Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation

Nov 22, 2025🔧 No Patch
CVE-2025-11859
CVSS 6.4medium

Paypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Nov 11, 2025🔧 No Patch
CVE-2025-10309
CVSS 4.3medium

PayPal Forms <= 1.0.3 - Cross-Site Request Forgery

Oct 3, 2025🔧 No Patch
https://www.theregister.com/2025/08/28/euro_banks_block_paypal_direct_debits/
unknown

Euro banks block billions in rogue PayPal direct debits after fraud glitch

Aug 28, 2025🔧 No Patch

Monitor paypal in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.