CVE-2026-6939 is a stored cross-site scripting vulnerability in the CorvusPay WooCommerce Payment Gateway plugin for WordPress. The issue is due to improper neutralization of input in the 'approval_code' parameter, which is stored and later rendered without sufficient sanitization or escaping. An unauthenticated REST endpoint (/wp-json/corvuspay/success/) is registered with a permission callback that always returns true, and although signature validation is logged, it does not prevent malicious input from being stored. This allows attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability affects all plugin versions up to and including 2.7.4.

An attacker can inject and store malicious scripts via the 'approval_code' parameter without authentication. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable REST endpoint and implement additional input validation or output escaping as a temporary mitigation. Monitor vendor channels for updates and apply official patches promptly once released.