The PeachPay Payments & Express Checkout plugin for WooCommerce (supporting Stripe, PayPal, Square, Authorize.net, NMI) suffers from a reflected cross-site scripting vulnerability (CWE-79) identified as CVE-2024-11362. The vulnerability is due to the use of the add_query_arg function without proper escaping of URL parameters in all versions up to 1.112.0. This allows unauthenticated attackers to inject malicious scripts into URLs that execute in the context of the victim's browser if they click on a crafted link. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session when the victim clicks a malicious link. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or manipulation of web page content within the affected plugin's context. There is no impact on system availability. The vulnerability requires user interaction and affects the scope beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking on suspicious links related to the plugin and consider disabling or removing the plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.