payment_gateway vulnerabilities

CVEs whose affected-version data names the payment_gateway package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-103299None

today

nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification …

▾ Sunlitvia CVEORG