{"id":"CVE-2026-118085","kind":"vulnerability","aliases":["CVE-2026-118085"],"related":[],"title":"GlobalPayments WooCommerce plugin: unauthenticated XSS in versions up to 1.23.3","description":"Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.","summary":"The GlobalPayments WooCommerce payment plugin up to version 1.23.3 has a cross-site scripting flaw that needs no login. An attacker can inject script into pages that other users load, which can run in their browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["globalpayments","package","payments","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the GlobalPayments WooCommerce plugin in the WordPress plugins list or `wp plugin get <plugin-slug>`\n- Confirm whether the installed version is `1.23.3` or older","fix":"- Move to a version newer than `1.23.3`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-10-29T16:18:03+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:30:03+00:00","updated_at":"2026-10-29T16:30:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:30:03Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version newer than `1.23.3`; the exact fixed version is unknown from the sources","reach":"internet","title":"GlobalPayments WooCommerce plugin: unauthenticated XSS in versions up to 1.23.3","impact":"medium","summary":"The GlobalPayments WooCommerce payment plugin up to version 1.23.3 has a cross-site scripting flaw that needs no login. An attacker can inject script into pages that other users load, which can run in their browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","globalpayments","payments"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in customer and admin browsers on the store","analyst_note":"Find the fixed version and the vulnerable endpoint from the NVD entry or the plugin changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-118085).","how_to_check":"- Check the installed version of the GlobalPayments WooCommerce plugin in the WordPress plugins list or `wp plugin get <plugin-slug>`\n- Confirm whether the installed version is `1.23.3` or older","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the GlobalPayments WooCommerce plugin at version 1.23.3 or older on WordPress are exposed. The sources do not say which page or request path is vulnerable, so unknown whether checkout pages alone are affected. Sites that do not run this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4080,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118085':13A,16A '-2026':12A,15A '1.23.3':10A,30B,67C 'attack':43B 'browser':58B 'cross':34B,60C 'cross-sit':33B 'cve':11A,14A 'flaw':37B 'globalpay':1A,17B,23B,65C 'inject':45B 'load':52B 'login':41B 'need':39B 'packag':18B 'page':48B 'payment':19B,25B 'plugin':3A,26B 'run':55B 'script':36B,46B,62C 'site':35B,61C 'unauthent':4A,59C 'user':51B 'version':7A,29B,68C 'woocommerc':2A,20B,24B,66C 'wordpress':21B 'xss':5A,63C","nicknames":[],"mitigations":[],"who_affected":"Stores running the GlobalPayments WooCommerce plugin at version 1.23.3 or older on WordPress are exposed. The sources do not say which page or request path is vulnerable, so unknown whether checkout pages alone are affected. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118085","severity":null,"published_at":"2026-10-29T16:18:03+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}