High severity · published Oct 1, 2026
CVE-2026-81739
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Paytm Payment Gateway ·
before 2.8.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81739
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81739
exploit
https://wpscan.com/vulnerability/f77f3f04-cb98-4687-9080-dd0c99a7e926/
More from Paytm Payment Gateway
7.5
CVE-2026-81809
Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
5.3
CVE-2026-81740
Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback