Razorpay
7 CVEs across 6 Razorpay products. Browse Razorpay vulnerabilities, severities, and proof-of-concept exploits.
Razorpay products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94179 | High | 7.1 | 2026-09-23 | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions. |
CVE-2026-74009 | Medium | 5.3 | 2026-08-18 | Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions. |
CVE-2026-39656 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-14294 | Medium | 5.3 | 2026-02-19 | The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() f… |
CVE-2024-13827 | Medium | 6.1 | 2025-03-05 | The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and re… |
CVE-2024-10851 | Medium | 6.1 | 2024-11-13 | The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg with… |
CVE-2024-10850 | Medium | 6.1 | 2024-11-13 | The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_quer… |