CVE-2026-7517

Name of the Vulnerable Software and Affected Versions Custom Payment Gateways for WooCommerce versions prior to 2.1.1

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. An unauthenticated guest user can inject arbitrary web scripts by submitting a crafted checkout POST request using the alg wc cpg input fields parameter. These scripts execute whenever a user accesses the affected page.

Recommendations Update Custom Payment Gateways for WooCommerce to version 2.1.1 or later. As a temporary mitigation, disable the plugin until the update is applied.