Tomlister vulnerabilities

Products

• Payflex Payment Gateway 3

Latest Tomlister CVEs

Newest publication first

1. CVE-2026-103346 WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-06

   High·CVSS 7.1 EPSS 0.14%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

2. CVE-2024-47646 WordPress Payflex Payment Gateway plugin <= 2.6.1 - Open Redirection vulnerability

   Published 2024-10-05

   Medium·CVSS 4.7 EPSS 0.33%

   URL Redirection to Untrusted Site ('Open Redirect') vulnerability in tomlister Payflex Payment Gateway payflex-payment-gateway.This issue affects Payflex Payment Gateway: from n/a through <= 2.6.1.

3. CVE-2024-0619 Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update

   Published 2024-07-11

   Medium·CVSS 5.3 EPSS 0.40%

   The Payflex Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the payment_callback() function in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to update the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.