PAYCOMET for WooCommerce CVE-2026-109701

Exploitation requires an attacker to deliver a crafted link whose malicious parameter is reflected unsanitized by the PAYCOMET for WooCommerce plugin (versions n/a through 5.45), and requires a victim to click that link while the page is served - the UI:R metric confirms mandatory user interaction, which is the primary limiting factor. No authentication is required of the attacker per the vendor PR:N vector, but the payload only executes in the browser of the lured victim, so impact is scoped to that user's session on sites running the affected plugin. Realistic risk is further bounded by the need for a WooCommerce store to actually have this specific Spanish payment gateway installed and for a privileged user to be socially engineered into clicking.

This is a reflected cross-site scripting flaw (CWE-79) in the PAYCOMET for WooCommerce plugin, versions up to and including 5.45. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity issue requiring no attacker privileges but requiring victim interaction (UI:R), with a scope change and only low impact to confidentiality, integrity and availability - a profile typical of reflected XSS where the payload executes in the victim's browser session rather than directly compromising the server. No EPSS score, CISA KEV listing, SSVC decision data, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The reflected (non-stored) nature means an attacker must lure a victim into clicking a crafted link, which lowers real-world risk relative to stored XSS or unauthenticated RCE; this is a moderate-priority patch-management item rather than an emergency. The A:L/I:L markings in the vendor vector are generous for a reflected XSS whose practical impact is browser-context script execution - treat the 7.1 as a conservative upper bound.

An attacker crafts a URL pointing at a vulnerable PAYCOMET for WooCommerce page containing an unsanitized parameter that is reflected into the response, then delivers it to a logged-in store administrator or customer via phishing email or a malicious link. When the victim clicks it, the injected JavaScript executes in their browser in the context of the store's domain, enabling session/cookie theft or actions on their behalf. No public proof-of-concept was provided in the input.