CVE-2026-7517: Stored XSS in Custom Payment Gateways for WooCommerce Plugin

Technical summary

CVE-2026-7517 is a Stored Cross-Site Scripting (XSS) vulnerability in the Custom Payment Gateways for WooCommerce plugin stemming from insufficient sanitization and output escaping of the 'alg_wc_cpg_input_fields' parameter. The plugin fails to properly validate and escape user-supplied input before storing it in the database and rendering it on checkout pages. Because the plugin does not require custom input fields to be explicitly configured for the vulnerability to be exploitable, unauthenticated attackers can inject arbitrary JavaScript by crafting a POST request to the checkout endpoint. The injected payload persists and executes in the context of any subsequent user session, meeting the definition of a stored XSS vulnerability. The CVSS 3.1 vector (7.2/HIGH) reflects network accessibility, low complexity, no privilege requirement, and impact on confidentiality and integrity across security boundaries (changed scope).

Business impact

E-commerce sites using this plugin face significant risk to customer trust and operational continuity. Attackers can harvest payment card details, session tokens, or personally identifiable information from checkout pages without modifying the site's appearance, making detection difficult. Compromised customer data may trigger breach notification obligations and regulatory fines under GDPR, PCI DSS, and similar frameworks. Additionally, malware injection could redirect users to fraudulent payment processors, creating liability for the merchant. The 'stored' nature of this XSS means the attack persists until remediated, potentially affecting thousands of customer transactions across an extended timeframe.

Affected systems

Custom Payment Gateways for WooCommerce plugin in all versions up to and including 2.1.0 are affected. The vulnerability exists in WordPress installations where this plugin is active, regardless of whether custom input fields are formally configured in the plugin settings. Any WooCommerce store using this plugin to process payments is at risk.

Exploitability

This vulnerability is highly exploitable. No authentication is required; an attacker need only send a crafted POST request to the checkout endpoint. The payload is stored persistently, so the attacker does not need to continuously deliver the malicious code. The lack of a configuration prerequisite (custom input fields do not need to be enabled) broadens the attack surface. Detection by users is minimal because the injected scripts are invisible in the HTML source that casual observers would inspect. Once stored, the payload executes in every user's browser, making this a particularly high-impact attack vector for e-commerce targets.

Remediation

Update the Custom Payment Gateways for WooCommerce plugin to a patched version that properly sanitizes the 'alg_wc_cpg_input_fields' parameter and escapes output when rendering it. Verify the specific patched version number against the vendor's official security advisory or plugin repository. As an interim measure, disable the plugin if immediate patching is not possible, or implement a Web Application Firewall (WAF) rule to block POST requests to the checkout endpoint containing suspicious JavaScript patterns. Review checkout page source and server logs for evidence of injected scripts.

Patch guidance

Visit the WordPress plugin repository or the plugin vendor's website to download the latest available version of Custom Payment Gateways for WooCommerce. Update through the WordPress admin dashboard (Plugins > Updates) after backing up your site. Verify in the release notes that the version explicitly addresses CVE-2026-7517 and input sanitization improvements. Test the checkout flow on a staging environment before deploying to production to confirm no functionality is broken. If a patched version is not yet available, contact the vendor for an estimated release date and consider temporarily disabling the plugin or using an alternative payment gateway.

Detection guidance

Review stored checkout data and database logs for anomalous strings containing script tags, event handlers (onclick, onload, etc.), or escaped JavaScript within the 'alg_wc_cpg_input_fields' field. Inspect your checkout page source in a browser (View Page Source) for unexpected script blocks or data attributes that were not intentionally added. Use a Web Application Firewall or SIEM to alert on POST requests to the checkout endpoint containing JavaScript patterns or known XSS payloads. Monitor user complaints about suspicious redirects or warnings from payment processors. Check WordPress security logs for unauthorized modifications to plugin files or database entries related to the payment gateway configuration.

Why prioritize this

This vulnerability scores 7.2/HIGH on the CVSS scale and merits immediate attention due to its direct impact on payment security and customer data. The combination of unauthenticated access, stored payload persistence, and broad applicability (no configuration required) creates a significant risk for any e-commerce operation. The scope change to 'Changed' in the CVSS vector means an attacker can impact resources beyond the vulnerable component itself—in this case, every user accessing checkout. Given that payment gateways are a prime target for financially motivated attackers, this should be treated as a critical business risk.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH severity) reflects: Attack Vector = Network (anyone can exploit remotely), Attack Complexity = Low (no special conditions required), Privileges Required = None (unauthenticated access), User Interaction = None (payload executes automatically), Scope = Changed (affects users beyond the vulnerable plugin), and partial impact on Confidentiality and Integrity (data theft and malware injection possible). The unchanged Availability score reflects that this is not a denial-of-service vector. The HIGH rating appropriately captures the serious but not critical nature of the threat; it would only reach CRITICAL if availability were also compromised or if the plugin were universally deployed on all major e-commerce platforms.

Frequently asked questions