CVE-2026-120856: WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

Q: What must an attacker do to exploit this issue?

An attacker can exploit the reflected XSS flaw remotely with low attack complexity and no privileges, but victim interaction is required. The provided data does not identify the specific input or page that must be used.

Q: Which installations are affected?

Invoice Gateway for WooCommerce – Invoice Payment Gateway versions through 1.1.6 are affected. The data does not state whether any particular WordPress or WooCommerce configuration changes exposure.

Q: What impact could successful exploitation have?

Successful exploitation may affect confidentiality, integrity, and availability at a low level, with scope changed. Because this is reflected XSS, the attack requires a victim to interact with attacker-controlled content.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.

Affected Software

1 affected component

Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway<=1.1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway to a version that resolves this vulnerability.
Fixed in 1.1.7

Event History

Nov 9, 2026

CVE Published

via MITRE·12:09 PM

Data Sourced

via MITRE·12:09 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker can exploit the reflected XSS flaw remotely with low attack complexity and no privileges, but victim interaction is required. The provided data does not identify the specific input or page that must be used.

Which installations are affected?

Invoice Gateway for WooCommerce – Invoice Payment Gateway versions through 1.1.6 are affected. The data does not state whether any particular WordPress or WooCommerce configuration changes exposure.

What impact could successful exploitation have?

Successful exploitation may affect confidentiality, integrity, and availability at a low level, with scope changed. Because this is reflected XSS, the attack requires a victim to interact with attacker-controlled content.

CVE-2026-120856: WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which installations are affected?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Which installations are affected?

What impact could successful exploitation have?