Live › vulnerability › CVE-2026-118085
The GlobalPayments WooCommerce payment plugin up to version 1.23.3 has a cross-site scripting flaw that needs no login. An attacker can inject script into pages that other users load, which can run in their browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Stores running the GlobalPayments WooCommerce plugin at version 1.23.3 or older on WordPress are exposed. The sources do not say which page or request path is vulnerable, so unknown whether checkout pages alone are affected. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get <plugin-slug>1.23.3 or older1.23.3; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118085")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.