CVE-2026-81739

{
  "etk_id": "ETK-2026-537",
  "cve_id": "CVE-2026-81739",
  "display_id": "CVE-2026-81739",
  "ghsa_id": "GHSA-hxqp-r3vv-h45f",
  "euvd_id": "EUVD-2026-90509",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Paytm Payment Gateway",
  "summary": "Paytm Payment Gateway for WordPress versions before 2.8.9 can retain untrusted payment callback data and display it in an administrative page without safe output handling. An unauthenticated attacker may cause script execution in a store administrator's browser when the gateway is enabled without configured credentials.",
  "mitigation": "Update Paytm Payment Gateway to version 2.8.9 or later. Until updated, disable the gateway or ensure its credentials are configured to reduce exposure.",
  "vendor": null,
  "product": "Paytm Payment Gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.8.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.8.9"
      ],
      "package_name": "Paytm Payment Gateway",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.5,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": 0.0022,
  "epss_percentile": 0.1139,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 20.535600583333334,
  "t0_at": "2026-10-01T06:00:23.972000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T02:06:15.657929+00:00",
      "days": 10.83740377232639,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T06:00:23.972000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-01T06:00:23.972000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T06:00:23.972000+00:00",
      "url": "https://github.com/advisories/GHSA-hxqp-r3vv-h45f"
    }
  }
}