Custom Payment Gateways for WooCommerce EUVD-2026-40902

Exploitation requires only that a WordPress site have the Custom Payment Gateways for WooCommerce plugin (version ≤ 2.1.0) installed and active with a reachable WooCommerce checkout; the description explicitly states it works even when no custom input fields are configured, so no non-default plugin setup is needed. The attacker sends a crafted checkout POST request supplying a malicious value in the 'alg_wc_cpg_input_fields' parameter as an unauthenticated guest (PR:N confirms no authentication). The key limiting factor is that this is stored XSS: the injected payload does not execute at injection time but only when a subsequent victim - in practice a logged-in administrator or staff user viewing the poisoned order/page - renders the stored data, so realized impact depends on a privileged user opening the affected page.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) reflects a remote, low-complexity, unauthenticated attack with a scope change into the victim's browser context and low confidentiality/integrity impact - consistent with the description stating unauthenticated guests can trigger it with no plugin-specific configuration. No EPSS score, KEV entry, or POC was provided, so likelihood signals are limited: absence of KEV and no public exploit suggest this is not currently subject to mass exploitation, but stored XSS in WooCommerce plugins is a well-understood, easily weaponized class, so the low real-world-exploit signal should not be read as low exploitability. One caveat to verify: the vector marks UI:N, yet a stored-XSS payload only fires when a victim (e.g., an admin) later views the injected page - defenders should treat the practical trigger as requiring a privileged user to open the poisoned order/page, which slightly tempers the raw score. Net: a genuine priority for sites running this plugin because the injection step needs no authentication and no special setup.

An unauthenticated attacker submits a crafted checkout POST request to a store running the plugin, placing a malicious <script> payload in the 'alg_wc_cpg_input_fields' parameter, which is stored with the order. When a store administrator later opens that order in the WordPress dashboard, the script executes in their authenticated session and can steal cookies, forge admin actions, or create a new admin account. No exploit code is publicly identified, but the attack requires only a single crafted HTTP request and no authentication or special plugin configuration.