CVE-2026-81739 — Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

CVE-2026-81739

Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback PUBLISHED

Description (CNA)

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

Affected (CNA)

Vendor / product	Versions
Unknown / Paytm Payment Gateway	affected 0 before 2.8.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f77f3f04-cb98-4687-9080-dd0c99a7e926/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.