{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/paycomet/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:paycomet:paycomet_for_woocommerce:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-109701"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PAYCOMET for WooCommerce (n/a - 5.45)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application-vulnerability","ecommerce"],"_cs_type":"advisory","_cs_vendors":["PAYCOMET"],"content_html":"\u003cp\u003ePAYCOMET for WooCommerce, a payment gateway integration for the WooCommerce platform, contains a critical input neutralization vulnerability identified as CVE-2026-109701. The flaw exists due to improper validation of user-supplied input during web page generation. This reflected cross-site scripting (XSS) vulnerability permits an attacker to craft malicious URLs containing injected script payloads. When a victim, such as an administrator or authenticated user, interacts with the manipulated link, the injected script executes within their browser session. This can lead to unauthorized actions performed on behalf of the user, potential credential theft, or session hijacking. The issue affects all versions of the plugin up to and including version 5.45. Defenders should prioritize updating the plugin to the latest version to mitigate this risk, as reflected XSS remains a primary vector for account takeover in e-commerce environments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-109701 allows unauthenticated attackers to execute arbitrary JavaScript in the context of an end-user's session. In the context of an e-commerce store using WooCommerce, this could allow attackers to steal session cookies, capture administrative credentials, or manipulate payment transaction displays. The vulnerability poses a significant risk to the integrity of the checkout process and the security of user sessions for any store running the PAYCOMET plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the PAYCOMET for WooCommerce plugin to the latest version, ensuring it is beyond version 5.45, as documented in the vendor release notes for CVE-2026-109701.\u003c/li\u003e\n\u003cli\u003eAudit web application logs for HTTP requests containing suspicious script tags or JavaScript event handlers in URL parameters directed at the WooCommerce store.\u003c/li\u003e\n\u003cli\u003eImplement a strict Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external domains, which can mitigate the impact of reflected XSS vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T21:53:42Z","date_published":"2026-10-17T21:53:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-paycomet-xss/","summary":"PAYCOMET for WooCommerce versions 5.45 and earlier are vulnerable to reflected cross-site scripting (XSS), allowing unauthenticated attackers to execute arbitrary scripts in the context of a victim's session.","title":"Reflected Cross-Site Scripting in PAYCOMET for WooCommerce","url":"https://feed.craftedsignal.io/briefs/2026-10-paycomet-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - PAYCOMET","version":"https://jsonfeed.org/version/1.1"}