Paytm Payment Gateway EUVD-2026-90509

Requires the Paytm Payment Gateway to be configured in a state where it is ENABLED WITHOUT credentials, which is what allows the callback integrity check to be forged by an unauthenticated attacker - this is the core non-default prerequisite. The attacker must send a crafted/forged payment callback whose data is stored by the plugin. Execution is further gated on user interaction (UI:R): a store administrator must subsequently view the admin page that renders the stored callback data unescaped. Limiting factors: the specific credential-less gateway configuration, the need for an admin to visit the affected page, and plugin versions before 2.8.9 only.

This is CWE-79 stored cross-site scripting in the Paytm Payment Gateway WordPress plugin (before 2.8.9). The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.5) describes a network-reachable, unauthenticated (PR:N) flaw, but two signals meaningfully lower real-world risk: AC:H reflects the non-default precondition that the gateway must be enabled WITHOUT credentials (so the callback integrity check can be forged), and UI:R reflects that payload execution waits on a store administrator opening the affected admin page. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The C:H/I:H/A:H impact rating is aggressive for XSS and appears to model full administrator-session compromise (the script runs in the admin's authenticated context); treat it as achievable-worst-case rather than guaranteed. Net: a credible but conditional stored-XSS-to-admin-takeover issue, not a mass-exploitation priority given the non-default config requirement and the absence of any exploitation telemetry. A vendor patch is available and should be the primary mitigation.

An unauthenticated attacker crafts a forged Paytm payment callback carrying a JavaScript payload in a stored field, abusing the fact that the callback integrity check is bypassable when the gateway is enabled without credentials. The plugin stores the unsanitized data and later renders it unescaped on a plugin admin page. When a store administrator opens that page, the script executes in their authenticated session, enabling actions up to account/site takeover. No public exploit code is identified in the supplied data.