Live › vulnerability › CVE-2026-54866
The Razorpay Payment Button plugin for Elementor, a WordPress add-on, has a cross-site scripting flaw reachable without logging in. An attacker can inject script that runs in the browser of a visitor or admin who loads the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Razorpay Payment Button plugin for Elementor at version 1.2.8 or older on WordPress with Elementor. The sources do not say which pages or settings expose the flaw, so unknown.
No product ranges from the sources yet.
1.2.8 or older.1.2.8; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.