Payflex Payment Gateway CVE-2026-103346

Exploitation requires an authenticated or unauthenticated victim to click an attacker-crafted link that reflects malicious input into a page generated by the Payflex Payment Gateway plugin (versions up to and including 2.7.1); the payload then executes in the victim's browser. The defining limiting factor is required user interaction (UI:R) - there is no automatic or server-side trigger, so a successful attack depends on social engineering the victim into visiting the crafted URL. Impact is further bounded to the victim's browser context (session/token theft, page manipulation) rather than server-side compromise, and value is highest when the victim is a privileged WordPress user.

This is a reflected cross-site scripting (CWE-79) flaw in the Payflex Payment Gateway WordPress plugin (through 2.7.1), rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The network vector, low complexity, and no-privilege requirement raise the nominal score, but the UI:R (user interaction required) metric is the dominant limiting factor: an attacker cannot exploit a victim without tricking them into clicking a crafted link, which makes this unsuitable for automated, wormable, or mass exploitation. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The elevated base score is driven partly by the scope-change metric (S:C) that Patchstack conventionally assigns to XSS; the true technical impact of a reflected XSS is limited (session/token theft or UI manipulation in the victim's browser, not server compromise). Net assessment: a genuine but moderate, socially-engineered vulnerability - real enough to patch on a normal cycle, not a drop-everything emergency, and far below the real-world urgency of an unauthenticated RCE despite the 7.1 label.

An attacker crafts a malicious URL pointing at a vulnerable parameter in a WordPress site running Payflex Payment Gateway and delivers it via phishing email, a malicious ad, or a forum post. When a logged-in administrator or customer clicks the link, the unsanitized input is reflected into the page and the attacker's JavaScript executes in their browser session, enabling session cookie theft or actions performed as that user. No public proof-of-concept is referenced, and because UI:R applies, exploitation depends entirely on convincing the victim to follow the link.