Paytm WordPress Plugin Stored XSS via Payment Callbacks

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Paytm Payment Gateway WordPress plugin versions before 2.8.9. Attackers can inject malicious scripts through forged payment callback data when the gateway is configured without proper credentials, storing the payload in the WordPress database. When administrators access the affected admin page, the unescaped scripts execute in their browser session with full administrative privileges. This affects any WordPress site using this popular payment plugin, potentially compromising store operations, customer data, and site integrity. The attack requires no authentication and exploits weak callback verification, making it a critical supply chain risk for e-commerce platforms.

Casky's 323 mapped skills leverage Claude's extended reasoning to detect the attack patterns behind TA0001 (Initial Access via unauthenticated callback manipulation) and TA0043 (Persistence through stored malicious scripts in admin contexts). Practitioners using Casky would identify findings across multiple skill categories: input validation gaps where callback parameters lack sanitization, output encoding failures in admin template rendering, and authentication/authorization weaknesses in callback verification logic. The platform would flag suspicious callback data patterns, detect script-like strings persisting in database queries, and correlate admin page rendering with untrusted data sources. A practitioner's findings would specifically highlight the CWE-79 violation chain—how unsanitized input flows from payment gateways through database storage to admin page output—and recommend immediate plugin updates, callback verification enforcement, and Content Security Policy headers to mitigate stored XSS execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-81739.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-81739

Casky has 323 skills that investigate the attack patterns behind CVE-2026-81739. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn