Is CVE-2026-81292 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81292 being exploited in the wild.

How severe is CVE-2026-81292?

High severity, with a CVSS score of 7.1, published 3 September 2026.

Which products and versions are affected?

Yalla Ya! Simple Payment <=2.5.1.

Is there a fix for CVE-2026-81292?

A patch was published on 2026-09-02: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81292 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-81292?

Check whether you run Yalla Ya! Simple Payment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81292: Simple Payment plugin unauthenticated cross-site scripting

Q: Is there a fix for CVE-2026-81292?

A patch was published on 2026-09-02: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-81292 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-81292?

Check whether you run Yalla Ya! Simple Payment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81292 · Severity: high · CVSS 7.1 · Published 2026-09-03

The Simple Payment WordPress plugin contains a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into affected websites. An attacker can craft a malicious link or page that, when visited by an administrator or user, executes arbitrary JavaScript code that could steal account credentials, session tokens, or perform unauthorized actions on the site.

Technologies: Yalla Ya! Simple Payment. Vendors: Yalla Ya!.

Quick answers

Is CVE-2026-81292 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81292 being exploited in the wild.
How severe is CVE-2026-81292?: High severity, with a CVSS score of 7.1, published 3 September 2026.
Which products and versions are affected?: Yalla Ya! Simple Payment <=2.5.1.
Is there a fix for CVE-2026-81292?: A patch was published on 2026-09-02: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81292 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-81292?: Check whether you run Yalla Ya! Simple Payment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an unauthenticated reflected or stored cross-site scripting (XSS) vulnerability in the Simple Payment WordPress plugin version 2.5.1 and earlier. The vulnerability allows attackers to inject arbitrary HTML and JavaScript payloads into the plugin's output without proper input validation or output encoding. While user interaction is required (an administrator or privileged user must click a malicious link or visit a crafted page), no authentication is needed to create the payload. Successful exploitation enables attackers to steal sensitive data, hijack user sessions, or perform actions with the privileges of the victim user. The vulnerability has been patched in version 2.5.2.

Affected products

yalla ya! Simple Payment <=2.5.1

Timeline

2026-09-03: disclosed: CVE-2026-81292 published
2026-09-02: patched: Version 2.5.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.