{"id":"CVE-2026-120856","kind":"vulnerability","aliases":["CVE-2026-120856"],"related":[],"title":"Invoice Gateway for WooCommerce: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.","summary":"Invoice Gateway for WooCommerce, a WordPress payment plugin by Rymera Web Co, has a reflected cross-site scripting flaw. An attacker can craft a link that runs their script in the browser of a user who opens it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-above-1.1.6"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/invoice-gateway-for-woocommerce`\n- Compare the version against `1.1.6`, the last affected version named in the advisory","fix":"- Invoice Gateway for WooCommerce: move to a version later than `1.1.6`; the sources do not name the exact fixed release","status":"open","published_at":"2026-11-09T13:17:06+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:34+00:00","updated_at":"2026-11-09T13:27:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T13:27:34Z","model":"claude-haiku-5-5","output":{"fix":"- Invoice Gateway for WooCommerce: move to a version later than `1.1.6`; the sources do not name the exact fixed release","reach":"internet","title":"Invoice Gateway for WooCommerce: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"Invoice Gateway for WooCommerce, a WordPress payment plugin by Rymera Web Co, has a reflected cross-site scripting flaw. An attacker can craft a link that runs their script in the browser of a user who opens it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker scripts run in customer or admin browsers on the store","analyst_note":"Confirm the first fixed version and the exact product slug from the NVD or vendor page at https://nvd.nist.gov/vuln/detail/CVE-2026-120856","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/invoice-gateway-for-woocommerce`\n- Compare the version against `1.1.6`, the last affected version named in the advisory","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-1.1.6"],"who_is_affected":"Stores running the Invoice Gateway for WooCommerce plugin at version 1.1.6 or earlier are exposed. The flaw is reflected, so a visitor must open a crafted link; sites without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4603,"output_tokens":628,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120856':16A,19A '-2026':15A,18A '1.1.6':108C 'affect':97C 'allow':93C 'attack':8A,47B 'browser':13A,58B 'co':37B,80C 'craft':49B 'cross':42B,73C 'cross-sit':41B,72C 'cve':14A,17A 'flaw':45B 'gateway':2A,27B,82C,87C,90C,99C,104C 'generat':71C 'host':23B 'improp':64C 'input':67C 'invoic':1A,26B,81C,85C,89C,98C,102C 'invoice-gateway-for-woocommerc':88C 'issu':96C 'let':7A 'link':51B 'n/a':106C 'neutral':65C 'open':63B 'packag':20B 'page':70C 'payment':32B,86C,103C 'plugin':33B 'reflect':5A,40B,94C 'run':9A,53B 'rymera':35B,78C 'script':10A,44B,55B,75C 'self':22B 'self-host':21B 'site':43B,74C 'user':61B 'visitor':12A 'vulner':76C 'web':36B,69C,79C 'woocommerc':4A,24B,29B,84C,92C,101C 'wordpress':25B,31B 'xss':6A 'xss.this':95C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Invoice Gateway for WooCommerce plugin at version 1.1.6 or earlier are exposed. The flaw is reflected, so a visitor must open a crafted link; sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120856':16A,19A '-2026':15A,18A 'attack':8A 'browser':13A 'cve':14A,17A 'gateway':2A 'invoic':1A 'let':7A 'reflect':5A 'run':9A 'script':10A 'visitor':12A 'woocommerc':4A 'xss':6A","search_b":"'attack':47B 'browser':58B 'co':37B 'craft':49B 'cross':42B 'cross-sit':41B 'flaw':45B 'gateway':27B 'host':23B 'invoic':26B 'link':51B 'open':63B 'packag':20B 'payment':32B 'plugin':33B 'reflect':40B 'run':53B 'rymera':35B 'script':44B,55B 'self':22B 'self-host':21B 'site':43B 'user':61B 'web':36B 'woocommerc':24B,29B 'wordpress':25B,31B","search_c":"'1.1.6':108C 'affect':97C 'allow':93C 'co':80C 'cross':73C 'cross-sit':72C 'gateway':82C,87C,90C,99C,104C 'generat':71C 'improp':64C 'input':67C 'invoic':81C,85C,89C,98C,102C 'invoice-gateway-for-woocommerc':88C 'issu':96C 'n/a':106C 'neutral':65C 'page':70C 'payment':86C,103C 'reflect':94C 'rymera':78C 'script':75C 'site':74C 'vulner':76C 'web':69C,79C 'woocommerc':84C,92C,101C 'xss.this':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120856","severity":null,"published_at":"2026-11-09T13:17:06+00:00","modified_at":"2026-11-09T13:17:06+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}