Unknown Nexi Xpay Build vulnerabilities

3 CVEs affecting Unknown Nexi Xpay Build, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-82212, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-82213, published 2026-09-11. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other…
CVE-2026-82211, published 2026-10-07. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed,…
CVE-2026-82212, published 2026-10-07. High severity, CVSS 7.5. EPSS: 0.1% chance of exploitation in the next 30 days. The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token,…