Razorpay Payment Button CVE-2026-94179

Exploitation requires an unauthenticated attacker (PR:N) to deliver a crafted link/request that reflects an unsanitized parameter through the Razorpay Payment Button plugin (versions <=2.4.9) on a WordPress site, AND requires a victim to interact by clicking that link (UI:R) so the payload renders in their browser. The primary limiting factor is this mandatory user interaction - there is no server-side compromise and no autonomous, unauthenticated remote trigger; impact is confined to script execution in the clicking user's browser session. No non-default configuration is documented, but the plugin must be installed and active on the target site.

This is a high-CVSS (7.1) but modest real-world-risk reflected XSS in the Razorpay Payment Button WordPress plugin (<=2.4.9). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network reach with no privileges required, but exploitation hinges on UI:R - a victim must click an attacker-crafted link - which materially lowers the practical risk versus a no-interaction flaw. The scope change (S:C) reflects script executing in the victim's browser session context, but confidentiality/integrity/availability impacts are all Low, consistent with reflected XSS rather than a takeover primitive. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The A:L (availability) sub-score is arguable for a reflected XSS and mildly inflates the 7.1; I lean toward A:N and roughly 6.1. Net: a legitimate item to patch but not an emergency - priority is driven by ease of tricking a user, not by mass automatable exploitation. Note: the Tags and Description omit the WordPress/PHP platform, which is confirmed by the Patchstack reference URL (wordpress/plugin/razorpay-payment-button).

An attacker crafts a URL to a vulnerable Razorpay Payment Button plugin endpoint (or a page embedding it) containing a malicious script payload in a reflected parameter, then lures a site visitor or administrator into clicking it. When the victim's browser renders the unsanitized reflected input, the injected JavaScript executes in their session context, enabling session/cookie theft, defacement, or actions on their behalf. No public POC or exploit code was provided in the source data.