EUVD-2026-40902
GHSA-6q84-x2rr-737v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote injection needs no auth or special config (PR:N/AC:L), stored XSS executing in a privileged browser context yields scope change (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable by unauthenticated guest users submitting a crafted checkout POST request, requiring no custom input fields to be configured in the plugin.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Custom Payment Gateways for WooCommerce WordPress plugin (all versions through 2.1.0) lets unauthenticated guests plant persistent JavaScript by submitting a crafted checkout POST request via the 'alg_wc_cpg_input_fields' parameter. The injected script executes in the browser of any user - including store administrators - who later views the affected page, enabling session/account compromise in the WordPress admin context. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, no-configuration-required attack path makes it materially exploitable against default installs.
Technical ContextAI
The affected component is a third-party WooCommerce extension (vendor 'dhruvin', CPE cpe:2.3:a:dhruvin:custom_payment_gateways_for_woocommerce) that lets store owners attach custom input fields to payment gateways at checkout. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-controlled data supplied through the checkout flow is stored and later rendered without sufficient sanitization on input or escaping on output. Wordfence's references point at class-alg-wc-custom-payment-gateways-input-fields.php (lines 86, 241, 264), the code responsible for processing and echoing these input-field values, which is where the untrusted 'alg_wc_cpg_input_fields' data reaches the page unescaped. Because the payload is persisted server-side and executes when the order/checkout data is subsequently viewed (typically in the admin order screen), this is stored rather than reflected XSS.
RemediationAI
Upstream fix available (committed via WordPress plugin SVN changeset 3578163, https://plugins.trac.wordpress.org/changeset?old=3578163%40custom-payment-gateways-woocommerce&new=3578163%40custom-payment-gateways-woocommerce); a released patched version above 2.1.0 is not independently confirmed from the provided data, so administrators should update to the latest available release of Custom Payment Gateways for WooCommerce and verify the installed version is newer than 2.1.0. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/1defa728-9f9d-4e8f-8f6c-432c615da7f5?source=cve) for the confirmed fixed version. If an update cannot be applied immediately, compensating controls include deploying a WAF rule (e.g., Wordfence) to block script/HTML metacharacters in the 'alg_wc_cpg_input_fields' checkout parameter, and, if the custom-payment-gateway input fields feature is not in use, deactivating the plugin entirely - noting this removes any custom checkout payment gateways the store depends on. As a mitigation for admin exposure, avoid opening suspicious orders in the WordPress dashboard and enforce strong admin session controls, since the payload fires in the admin's browser.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today