Live › vulnerability › CVE-2026-109701
Go to dashboardPAYCOMET for WooCommerce, a WordPress payment plugin, does not neutralize input in a web page it generates, so a crafted link can inject a reflected cross-site scripting payload. An attacker who gets a victim to open that link can run script in the victim's browser session on the store's site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running the PAYCOMET for WooCommerce plugin at version 5.45 or earlier are affected. The flaw is in a page the plugin generates from request input, so exposure depends on that page being reachable; the sources do not say which page or parameter. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get paytpv-for-woocommerce --field=versionwp-content/plugins/paytpv-for-woocommerce5.45; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.
This page as .md · .json · in your agent: get_signal("CVE-2026-109701")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.