Reflected Cross-Site Scripting in PAYCOMET for WooCommerce

PAYCOMET for WooCommerce, a payment gateway integration for the WooCommerce platform, contains a critical input neutralization vulnerability identified as CVE-2026-109701. The flaw exists due to improper validation of user-supplied input during web page generation. This reflected cross-site scripting (XSS) vulnerability permits an attacker to craft malicious URLs containing injected script payloads. When a victim, such as an administrator or authenticated user, interacts with the manipulated link, the injected script executes within their browser session. This can lead to unauthorized actions performed on behalf of the user, potential credential theft, or session hijacking. The issue affects all versions of the plugin up to and including version 5.45. Defenders should prioritize updating the plugin to the latest version to mitigate this risk, as reflected XSS remains a primary vector for account takeover in e-commerce environments.

Impact

Successful exploitation of CVE-2026-109701 allows unauthenticated attackers to execute arbitrary JavaScript in the context of an end-user's session. In the context of an e-commerce store using WooCommerce, this could allow attackers to steal session cookies, capture administrative credentials, or manipulate payment transaction displays. The vulnerability poses a significant risk to the integrity of the checkout process and the security of user sessions for any store running the PAYCOMET plugin.

Recommendation

• Update the PAYCOMET for WooCommerce plugin to the latest version, ensuring it is beyond version 5.45, as documented in the vendor release notes for CVE-2026-109701.
• Audit web application logs for HTTP requests containing suspicious script tags or JavaScript event handlers in URL parameters directed at the WooCommerce store.
• Implement a strict Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external domains, which can mitigate the impact of reflected XSS vulnerabilities.