CVE-2026-6939

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.

• CWE-79

• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php#L1713
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-gateway-corvuspay.php#L202
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.2/includes/class-wc-order-corvuspay.php#L185
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.3/includes/class-wc-gateway-corvuspay.php#L1713
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.3/includes/class-wc-gateway-corvuspay.php#L202
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/tags/2.7.3/includes/class-wc-order-corvuspay.php#L185
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/trunk/includes/class-wc-gateway-corvuspay.php#L1713
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/trunk/includes/class-wc-gateway-corvuspay.php#L202
• https://plugins.trac.wordpress.org/browser/corvuspay-woocommerce-integration/trunk/includes/class-wc-order-corvuspay.php#L185
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3576949%40corvuspay-woocommerce-integration&new=3576949%40corvuspay-woocommerce-integration
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a81c01-495f-4861-b66f-000072e99512?source=cve

Published

Jul 11, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6932The Woo Commerce Minimum Weight plugin for WordPress is vuln…4.3
• CVE-2026-69320Improper neutralization of special elements used in an os co…8.8
• CVE-2026-6933The Premmerce Dev Tools plugin for WordPress is vulnerable t…8.8
• CVE-2026-6936IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a denial-of-ser…6.5
• CVE-2026-6937The Appointment Booking Calendar — Simply Schedule Appointme…5.3
• CVE-2026-6938IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization…7.5
• CVE-2026-6940radare2 prior to 6.1.4 contains a path traversal vulnerabili…7.1
• CVE-2026-6941radare2 prior to 6.1.4 contains a path traversal vulnerabili…7.8
• CVE-2026-6942radare2-mcp version 1.6.0 and earlier contains an os command…8.8
• CVE-2026-6947DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-F…8.7
• CVE-2026-6948Velociraptor versions prior to 0.76.4 contain a resource exh…4.9
• CVE-2026-6951Versions of the package simple-git before 3.36.0 are vulnera…9.8