CVE-2026-109701
7.1HighPublished 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary scripts in a victim's browser session by tricking them into clicking a crafted link. This requires network access and user interaction.
Root cause
The plugin fails to sanitize user-supplied input before reflecting it back in the generated web page.
Affected systems
PAYCOMET for WooCommerce (paytpv-for-woocommerce) through 5.45
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade to a version higher than 5.45 once released by the vendor. If an update is unavailable, temporarily deactivate the PAYCOMET for WooCommerce plugin or block malicious request parameters via a WAF.
$ wp plugin update paytpv-for-woocommerceAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.