CVE-2026-81739

Summary

The Paytm Payment Gateway plugin fails to sanitize data from payment callbacks, allowing stored XSS in admin panels. When the gateway is misconfigured without credentials, any user can inject malicious scripts that execute in the administrator's browser session.

Exploitability

Exploitation requires an unauthenticated user to trigger a payment callback with forged data, which is moderately difficult but possible when the plugin is enabled without proper credentials.

Blast radius

If exploited, attackers could execute arbitrary JavaScript in the admin session, potentially leading to full administrator compromise, data exfiltration, or further attacks on the WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.8.9 or later to fix the sanitization and integrity check issues.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.