Live › vulnerability › CVE-2026-61993
Blockonomics 3.11.0 has an unauthenticated cross-site scripting flaw. An attacker can inject script that runs in a visitor's or administrator's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
WordPress/WooCommerce stores running the Bitcoin Payments – Blockonomics plugin at exactly version 3.11.0. An unauthenticated attacker can get script to run in a visitor's or admin's browser, but it needs the victim to click a crafted link or visit a crafted page. Sites without this plugin, or on other versions, can skip it. The exact vulnerable endpoint is not published.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| blockonomics-bitcoin-payments | wordpress | 3.11.0 | – |
Bitcoin Payments – Blockonomics (slug blockonomics-bitcoin-payments); version 3.11.0 is affected3.11.0 as the latest release and Patchstack says no official patch is available3.11.0; until then consider deactivating the plugin or applying a WAF/virtual patchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61993")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.