{"id":"CVE-2026-54866","kind":"vulnerability","aliases":["CVE-2026-54866"],"related":[],"title":"WordPress Razorpay Payment Button Elementor plugin: unauthenticated XSS in versions up to 1.2.8","description":"Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.","summary":"The Razorpay Payment Button plugin for Elementor, a WordPress add-on, has a cross-site scripting flaw reachable without logging in. An attacker can inject script that runs in the browser of a visitor or admin who loads the affected page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","razorpay","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed version of the Razorpay Payment Button plugin for Elementor in the WordPress admin plugin list; affected if it is `1.2.8` or older.","fix":"- Update the Razorpay Payment Button plugin for Elementor to a version newer than `1.2.8`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-29T16:18:10+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:59+00:00","updated_at":"2026-10-29T16:29:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:29:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Razorpay Payment Button plugin for Elementor to a version newer than `1.2.8`; the exact fixed version is unknown from the sources.","reach":"internet","title":"WordPress Razorpay Payment Button Elementor plugin: unauthenticated XSS in versions up to 1.2.8","impact":"medium","summary":"The Razorpay Payment Button plugin for Elementor, a WordPress add-on, has a cross-site scripting flaw reachable without logging in. An attacker can inject script that runs in the browser of a visitor or admin who loads the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","razorpay","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitor or admin browsers on the site","analyst_note":"Confirm the fixed plugin version and which pages or endpoints are vulnerable via the NVD entry and the Wordfence or plugin repository advisory.","how_to_check":"- Check the installed version of the Razorpay Payment Button plugin for Elementor in the WordPress admin plugin list; affected if it is `1.2.8` or older.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Sites running the Razorpay Payment Button plugin for Elementor at version 1.2.8 or older on WordPress with Elementor. The sources do not say which pages or settings expose the flaw, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4090,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-54866':16A,19A '1.2.8':13A,81C 'add':37B 'add-on':36B 'admin':64B 'affect':68B 'attack':51B 'browser':59B 'button':4A,30B,78C 'cross':42B,71C 'cross-sit':41B 'cve':14A,17A 'elementor':5A,20B,33B,79C 'flaw':45B 'host':25B 'inject':53B 'load':66B 'log':48B 'packag':21B 'page':69B 'payment':3A,29B,77C 'plugin':6A,31B,80C 'razorpay':2A,22B,28B,76C 'reachabl':46B 'run':56B 'script':44B,54B,73C 'self':24B 'self-host':23B 'site':43B,72C 'unauthent':7A,70C 'version':10A,82C 'visitor':62B 'without':47B 'wordpress':1A,26B,35B 'xss':8A,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Razorpay Payment Button plugin for Elementor at version 1.2.8 or older on WordPress with Elementor. The sources do not say which pages or settings expose the flaw, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54866","severity":null,"published_at":"2026-10-29T16:18:10+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}