Vulnerabilities and security researches forwp-easy-pay wp-easy-pay

Jun 07, 2024

CVE, Research URL: 206aa8b706721ec996e1673c01a3d16da642fd74
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: Feb 28, 2022
Research Description: WP EasyPay – Create Your Payment Forms to Pay with Square – Square for WordPress Plugin: Integrate Square with WordPress to Collect Payments [wp-easy-pay] < 3.2.3 WordPress WP EasyPay plugin < 4.0.2 - Sensitive Information Disclosure vulnerability Sensitive Information Disclosure vulnerability discovered in WordPress WP EasyPay plugin (versions < 4.0.2).
Affected versions: max 3.2.3.
Status: vulnerable

CVE, Research URL: CVE-2022-47177
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: May 25, 2023
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.
Affected versions: max 4.1.
Status: vulnerable

CVE, Research URL: CVE-2021-4411
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: Jul 12, 2023
Research Description: The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpep_download_transaction_in_excel() function. This makes it possible for unauthenticated attackers to trigger a transactions download via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 4.2.
Status: vulnerable

CVE, Research URL: CVE-2023-1465
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: Aug 16, 2023
Research Description: The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
Affected versions: max 4.1.
Status: vulnerable

CVE, Research URL: -
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: Jun 07, 2023
Research Description: Rejected reason: CVE split into individual CVE IDs for each software record.
Affected versions: max 3.2.3.
Status: vulnerable

Jul 25, 2024

CVE, Research URL: CVE-2024-5861
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: Jul 24, 2024
Research Description: The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.
Affected versions: max 4.2.4.
Status: vulnerable

Nov 15, 2024

CVE, Research URL: CVE-2022-4974
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: Oct 16, 2024
Research Description: The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected versions: max 4.0.2.
Status: vulnerable

Mar 30, 2026

CVE, Research URL: CVE-2026-32587
Home page URL: Security reports for WP EasyPay – Square for WordPress
Application: WP EasyPay – Square for WordPress
Date: Mar 16, 2026
Research Description: Missing Authorization vulnerability in Saad Iqbal WP EasyPay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.2.11.
Affected versions: max 4.2.11.
Status: vulnerable