CVE-2026-82213

MediumCVSS 5.3/10Last modified Sep 11, 2026

Description

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-822155.9The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications CVE-2026-822178.8In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent CVE-2026-82227.5A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf CVE-2026-822205.3Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.CVE-2026-822217.1Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-8222210.0Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n CVE-2026-822236.5Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-822247.1Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.CVE-2026-822257.4Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.CVE-2026-822269.8Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.CVE-2026-822278.5Contributor SQL Injection in WPBulky <= 1.2.2 versions.CVE-2026-822288.1Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.