CVE-2026-81739
Received Received - Intake

Unauthenticated Stored XSS in Paytm Payment Gateway WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: WPScan

Description
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-81739
EUVD
EUVD-2026-90509

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
paytm payment_gateway to 2.8.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the Paytm Payment Gateway WordPress plugin before version 2.8.9. Attackers can inject malicious scripts via payment callbacks that are not properly sanitized or escaped. These scripts are stored and later executed in the session of a store administrator when viewed on an admin page.

Detection Guidance

Check if the Paytm Payment Gateway WordPress plugin version is below 2.8.9. Inspect admin pages for unexpected scripts in stored data from payment callbacks. Look for unauthorized modifications to plugin files or admin interface behavior.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of the administrator, or gain unauthorized access to sensitive data. Since the attack is stored and triggered when an admin views a page, it can persist even after the initial injection.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using the affected plugin may face compliance violations and potential fines.

Mitigation Strategies

Update the Paytm Payment Gateway plugin to version 2.8.9 or later immediately. Disable the plugin if an update is not available. Review admin pages for suspicious scripts and remove any unauthorized entries. Ensure the gateway requires credentials for callbacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart