EUVD-2026-45129
GHSA-g666-vr5r-v828
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS via crafted URL requires victim click (UI:R); scope changes as script runs in browser origin (S:C); no credentials needed from attacker (PR:N); no availability impact for XSS.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the WooCommerce PlacetoPay Gateway family of plugins (all regional Evertec variants) allows unauthenticated network-based attackers to inject and execute arbitrary JavaScript in victims' browsers by abusing the unsanitized 'redirect-url' parameter - confirmed in versions up to and including 3.2.2 across at least six regional plugin variants (Colombia, Ecuador, Honduras, Uruguay, Belice, and base). Exploitation requires the attacker to socially engineer a victim into clicking a crafted link; no patch version has been identified in the available data, as the most recent release (3.2.2, dated 2026-04-22) addresses only a tax-validation issue and not this XSS. No public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) reflects a failure to sanitize or HTML-encode the 'redirect-url' GET parameter before echoing it back into the HTTP response. Wordfence identified the vulnerable code in GatewayMethod.php at four distinct locations (lines 600, 718, 1824, and 1852 of the 3.2.2 tag), indicating the unsanitized parameter is consumed across the payment redirect and return flows of the plugin's WooCommerce integration. The affected software family is published by Evertec (evertecinc.com) under the PlacetoPay/AvalPay payment brand and distributed as separate WordPress plugins per Latin American market: CPE strings confirm cpe:2.3:a:evertec:woocommerce_placetopay_gateway_colombia, _ecuador, _honduras, _uruguay, _belice, and the base woocommerce_placetopay_gateway. Because this is a reflected (non-persistent) XSS, the payload is delivered via a crafted URL rather than stored server-side.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the 3.2.2 release (2026-04-22) is the latest available and contains only a tax-validation change, not an XSS fix. Site operators should monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca87868-357b-4d71-9bf9-cd3b15b2555d) and the plugin's GitHub release page (https://github.com/placetopay/woocommerce-gateway-placetopay/releases) for a patched release. As compensating controls: deploy a Web Application Firewall rule to sanitize or block the 'redirect-url' parameter on affected payment redirect endpoints - Wordfence Premium users may receive a firewall rule automatically. Additionally, enforce a Content Security Policy (CSP) header with a strict script-src directive to limit the damage of any injected script. If the plugin is not actively processing transactions, consider temporarily deactivating it until a patch is available; deactivation prevents checkout functionality, which must be weighed against the XSS exposure.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today