Is CVE-2026-54866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54866 being exploited in the wild.

How severe is CVE-2026-54866?

High severity, with a CVSS score of 7.1, published 29 October 2026.

Which products and versions are affected?

Razorpay Payment Button Elementor Plugin 1.2.8 and earlier.

Is there a fix for CVE-2026-54866?

No fixed version is recorded yet. As immediate action, update the affected plugin. If you are unable to do so, contact your hosting provider or web developer for help. Patchstack has issued a mitigation rule to block attacks until an official patch becomes available. [{"kind": "disclosed", "at": "2026-10-29"}, {"kind": "other", "at": "2026-09-11", "note": "Reported by Ananda Dhakal (Patchstack)"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54866 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54866?

Check whether you run Razorpay Payment Button Elementor Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54866: Razorpay Payment Button Elementor Plugin unauthenticated XSS

CVE-2026-54866 · Severity: high · CVSS 7.1 · Published 2026-10-29

The Razorpay Payment Button Elementor Plugin is a WordPress extension that integrates payment processing into websites built with Elementor. An unauthenticated attacker can inject malicious scripts into affected sites, allowing them to steal visitor data, hijack user accounts, or deface website content without requiring any special permissions.

Vendors: Razorpay.

Quick answers

Is CVE-2026-54866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54866 being exploited in the wild.
How severe is CVE-2026-54866?: High severity, with a CVSS score of 7.1, published 29 October 2026.
Which products and versions are affected?: Razorpay Payment Button Elementor Plugin 1.2.8 and earlier.
Is there a fix for CVE-2026-54866?: No fixed version is recorded yet. As immediate action, update the affected plugin. If you are unable to do so, contact your hosting provider or web developer for help. Patchstack has issued a mitigation rule to block attacks until an official patch becomes available.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}, {"kind": "other", "at": "2026-09-11", "note": "Reported by Ananda Dhakal (Patchstack)"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54866 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54866?: Check whether you run Razorpay Payment Button Elementor Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

As immediate action, update the affected plugin. If you are unable to do so, contact your hosting provider or web developer for help. Patchstack has issued a mitigation rule to block attacks until an official patch becomes available.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-29"}, {"kind": "other", "at": "2026-09-11", "note": "Reported by Ananda Dhakal (Patchstack)"}]

Technical details

The plugin versions 1.2.8 and below contain a Cross Site Scripting (XSS) vulnerability that can be exploited by unauthenticated users. While the XSS can be initiated by an unauthenticated attacker, successful exploitation requires a privileged user (or visitor) to perform an action such as clicking a malicious link or visiting a crafted page. No official patch has been released as of the advisory date.

Affected products

Razorpay Payment Button Elementor Plugin 1.2.8 and earlier

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.