CVE-2026-81739: Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paytm Payment Gateway WordPress pluginto a version that resolves this vulnerability.Fixed in 2.8.9
Event History
Frequently Asked Questions
Which installations are exposed to unauthenticated exploitation?
Installations using Paytm Payment Gateway versions earlier than 2.8.9 are exposed when the gateway is enabled without credentials. In that configuration, an attacker can forge the payment-callback integrity check.
Does exploitation require an administrator to take any action?
Yes. An unauthenticated attacker can store malicious script through a forged payment callback, but the script executes when a store administrator views the affected admin page. No attacker account is required.
What is the impact if the stored script executes?
The script runs in the store administrator's session. The vulnerability is rated high with impacts to confidentiality, integrity, and availability.