CVE-2026-11324 describes a reflected cross-site scripting vulnerability (CWE-79) in the WooCommerce Placetopay Gateway Belice plugin for WordPress. The vulnerability is due to improper neutralization of input during web page generation, specifically in the 'redirect-url' parameter. Versions up to and including 3.2.2 are affected. An unauthenticated attacker can exploit this by crafting a malicious URL that injects scripts executed in the context of the victim's browser upon interaction. This can lead to partial confidentiality and integrity impacts but no availability impact. No official patch or remediation level has been provided as of the publication date.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser when the victim clicks a malicious link containing a crafted 'redirect-url' parameter. This can lead to partial disclosure of information and modification of data within the browser session. There is no impact on system availability. The vulnerability requires user interaction (clicking a link) and network access to the vulnerable web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links involving the 'redirect-url' parameter in affected versions. Monitoring vendor channels for updates and applying any forthcoming patches promptly is recommended.