CVE-2026-81292
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Simple Payment versions up to 2.5.1.
Risk Assessment
An attacker can exploit the vulnerability to execute scripts in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the Simple Payment extension to the latest patched version.
Other vulnerabilities in Simple Payment
See all- CVE-2026-96332High
Reflected XSS vulnerability in the Simple Payment plugin. Affects versions from n/a through 2.5.4.
- CVE-2026-62111Medium
The Simple Payment plugin in versions up to and including 2.5.4 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.
- CVE-2026-81767High
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS