Skip to content
OpenAdvisories

Vendor

AyeCode

16 known vulnerabilities.

Products

Payment forms, Buy now buttons, and Invoicing System | GetPaid 3 UsersWP 3 GeoDirectory 2 Location Manager 2 Ketchup Shortcodes 2 Restaurante 1 WordPress Payments Plugin | GetPaid 1 GetPaid 1 API KEY for Google Maps 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-124250

    WordPress GeoDirectory plugin <= 2.8.202 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202.

    AyeCode GeoDirectory
  • High 7.5
    CVE-2026-119749

    GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

    The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the un…

    AyeCode Payment forms, Buy now buttons, and Invoicing System | GetPaid Web / CMS
  • High 7.1
    CVE-2026-119747

    GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

    The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities inst…

    AyeCode Payment forms, Buy now buttons, and Invoicing System | GetPaid Web / CMS
  • High 7.5
    CVE-2026-85705

    Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters

    The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient…

    AyeCode Location Manager Web / CMS
  • High 7.1
    CVE-2025-52746

    WordPress Restaurante theme <= 3.0.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ayecode Restaurante restaurante allows Reflected XSS.This issue affects Restaurante: from n/a through <= 3.0.7.

    AyeCode Restaurante
  • High 8.5
    CVE-2024-43145

    WordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61.

    AyeCode GeoDirectory