Simple Payment

Simple Payment has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 7.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (50%). Other recurring categories include Authentication Bypass Using An Alternate Path Or Channel, Missing Authorization.

Every one of the 6 issues recorded for Simple Payment has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by Nguyen Xuan Chien. Simple Payment is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
7.3/ 10
Patch Coverage100%
Open

0

Fixed

6

Get automatic notifications for all Simple Payment vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-6688

Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin

Read the full analysis

Vulnerability Records

6 records
Simple Payment banner
Latestv2.5.6

Simple Payment

Ido Kobelkowsky

Author

Ido Kobelkowsky

5.0(3)
100/100
Last Updated
2026-09-09 (3d ago)
Active Installs
40+
Downloads
12,975
Requires WP
4.6+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2019-10-10 (7y ago)

Selling something shouldn’t require a full shopping cart. Simple Payment turns any WordPress post, page, block, form or button into a ready-to-pay product or service in minutes — and routes the money through the payment gateway you already trust. No bloated store to configure, no checkout to rebuild: just a shortcode (or a block, or an Elementor widget) and you are taking payments. From a single “Donate” button to installment plans, saved cards, subscriptions and multi-gateway checkouts, Simple Payment scales from a personal blog to a commercial site — while keeping sensitive card data out of your database. Why you’ll love it Sell in minutes, not days. Drop one shortcode on any page and you have a working, styled payment form. Post/page titles become the product name and a custom field becomes the price — automatically. Use the gateway you already have. One consistent form and workflow in front of many gateways — switch providers without rebuilding your pages. Built for real money flows. Installments, monthly subscriptions / recurring, saved-card tokenization, refunds, invoices/receipts, and automatic transaction verification. Beautiful, flexible forms. Multiple templates (Bootstrap, Legacy, Donation, free-amount), inline, IFRAME or modal display, and full support for your own theme templates. Privacy first. PCI-DSS friendly: card data is masked/redacted before anything touches the database, and old records can be auto-archived and purged. Developer friendly. A rich set of actions and filters, a documented Engine API to extend any gateway or build your own, plus a full transactions log with filtering and CSV export. Supported payment gateways (Engines) PayPal, Cardcom, iCount, PayMe, iCredit, CreditGuard, Meshulam, YaadPay, Credit2000, WooCommerce (third-party site), plus a Custom engine for anything else and a Test engine for development. NEW: Sell on one site, charge on another (WooCommerce engine) The WooCommerce engine lets your site take a purchase and hand the actual payment off to a separate, third-party WooCommerce store over its REST API — perfect for agencies, marketplaces, franchises and multi-brand operators who want a central “storefront” and one billing store that owns the gateways, invoices and bookkeeping. The customer clicks Buy on your site; Simple Payment creates the order on the remote WooCommerce store with the correct total and customer details. The shopper pays on the remote store (in a redirect, popup or modal) using whatever gateways that store has enabled. A bundled Companion mode on the receiving store validates and keeps the originating parameters, can auto-complete paid orders, silences the remote store’s duplicate customer/admin emails for outsourced requests, and sends the customer straight back to your site when payment succeeds. You keep a full record of every transaction on the originating site, with automatic status verification. Works with your favorite tools Gutenberg block editor, Elementor, WooCommerce, WPJobBoard, GravityForms and Form Maker — plus Zapier to trigger workflows (CRM, email, spreadsheets, fulfilment) on every payment. What you can build One-click “Buy” / “Donate” buttons anywhere on your site Pay-what-you-want donation forms with a free-entry amount Membership, course or service checkouts on a single landing page Installment plans and monthly subscriptions Central storefront that bills through a separate WooCommerce store Currently on Beta: PayMe – please contact if you require assistance. Soon to be released: Pelecard, Tranzila. PS: You’ll need a Simple Payment API key for advanced gateways to use it. Keys are available for personal blogs; single domain, multiple domains, businesses and commercial sites. Feedback and Support I would be happy to receive your feedback to improve this plugin. Please let me know through support forums if you like it and please be sure to leave a review.. Also you can contact me on my personal page Ido Kobelkowsky or even visit Github of Simple Payment where you can find all the development code of this plugin. I hope it is useful for you and look forward to reading your reviews! 😉 Thanks! Advanced Configuration: Theme Custom Payment Processing To write your own payment processing integration, to be plugin, read the information at this link: https://simple-payment.yalla-ya.com/ you will require to write a simple php class that Pre Process, Process and Post Process the transaction with your your payment gateway.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C