sylius/paypal-plugin

PayPal plugin for Sylius.

Latest v2.1.0

Packagist

92%

Total Score

healthy

Active releases and organization backing support this package; all five workflow actions are unpinned.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

Both workflows were analyzed successfully with no audit findings or untrusted checkout and script-injection paths. However, all 5 action references are unpinned and one workflow grants top-level write permissions, creating a moderate reproducibility and token-scope hygiene concern.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-951311 sylius/paypal-plugin is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.0.0 - 1.7.8 and 2.0.0 - 2.0.10.	1.0.0 - 1.7.82.0.0 - 2.0.10	Critical
CVE-2025-30152 sylius/paypal-plugin is vulnerable to External Control of Assumed-Immutable Web Parameter in versions 0.0.0 - 1.6.2, 1.7.0 - 1.7.2 and 2.0.0 - 2.0.2.	0.0.0 - 1.6.21.7.0 - 1.7.22.0.0 - 2.0.2	Medium
CVE-2025-29788 sylius/paypal-plugin is vulnerable to External Control of Assumed-Immutable Web Parameter in versions 0.0.0 - 1.6.1, 1.7.0 - 1.7.1 and 2.0.0 - 2.0.1.	0.0.0 - 1.6.11.7.0 - 1.7.12.0.0 - 2.0.1	Medium
CVE-2021-41120 sylius/paypal-plugin is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.0.0 - 1.2.4 and 1.3.0 - 1.3.1.	1.0.0 - 1.2.41.3.0 - 1.3.1	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
sylius/sylius Version ^2.0.1	—	—
symfony/mailer Version ^6.4 \|\| ^7.4 \|\| ^8.0	—	—
psr/http-client Version ^1.0	—	—
sylius/telemetry Version ^1.0	—	—
php-http/discovery Version ^1.20	—	—