Nexi XPay Build vulnerabilities
We track 2 vulnerabilities in Nexi XPay Build products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest Nexi XPay Build vulnerabilities
- 7.5 High severity
Nexi XPay Build: Insufficient Verification of Data Authenticity
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary order
- 8.2 High severity
Nexi XPay Build: Missing Authorization
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest