corvusinfo CorvusPay WooCommerce Payment Gateway

• CVE-2026-6939 High 7.2 CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter 0.6%
• CVE-2026-9028 Medium 5.3 CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter 0.5%
• CVE-2026-9027 Medium 5.3 CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint 0.4%