Skip to content
OpenAdvisories

Vendor

Razorpay

9 known vulnerabilities.

Products

Razorpay for WooCommerce 3 Razorpay Payment Button Elementor Plugin 2 Razorpay Subscription Button Elementor Plugin 1 Razorpay Payment Button Plugin 1 Razorpay Payment Button 1 IFSC 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-110222

    Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup

    Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs …

    Razorpay IFSC
  • Medium 5.3
    CVE-2026-74009

    WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

    Razorpay Razorpay for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-39656

    WordPress Razorpay for WooCommerce plugin <= 4.8.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.

    Razorpay Razorpay for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-14294

    Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification

    The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permi…

    Razorpay Razorpay for WooCommerce Web / CMS
  • Medium 6.1
    CVE-2024-13827

    Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions

    The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and remove_query_arg() functions without appropriate escaping on the URL in all versions up to, and includ…

    Razorpay Razorpay Subscription Button Elementor Plugin Web / CMS
  • Medium 6.1
    CVE-2024-10850

    Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting

    The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This make…

    Razorpay Razorpay Payment Button Elementor Plugin Web / CMS
  • Medium 6.1
    CVE-2024-10851

    Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting

    The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possi…

    Razorpay Razorpay Payment Button Plugin Web / CMS