payloadcms plugin-ecommerce vulnerabilities

Latest payloadcms plugin-ecommerce CVEs

Newest publication first

1. CVE-2026-105850 Payload: Order confirmation validation issue in Payload Ecommerce

   Published 2026-10-06

   High·CVSS 8.8

   Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under ce...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.