CVE-2026-109701: WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
PAYCOMET for WooCommerce versions through 5.45 are affected. The provided data does not identify a lower affected version, so deployments using any version in that stated range should be reviewed.
What does an attacker need to exploit this issue?
The vulnerability is network-accessible, has low attack complexity, and requires no attacker privileges. Exploitation requires user interaction, meaning a target must interact with attacker-controlled content or a crafted request.
What is the potential impact of successful exploitation?
Successful reflected XSS can affect confidentiality, integrity, and availability at a low level. The CVSS vector also indicates scope change, meaning the impact may extend beyond the vulnerable plugin's immediate security authority.
How can I determine whether my site is affected?
Check whether the site has the PAYCOMET for WooCommerce plugin installed and identify its version. Versions 5.45 or earlier fall within the affected range stated in the advisory.