CVE-2026-7517 is a stored Cross-Site Scripting vulnerability in the Custom Payment Gateways for WooCommerce plugin for WordPress. The flaw exists due to insufficient sanitization and escaping of the 'alg_wc_cpg_input_fields' parameter in versions up to and including 2.1.0. An unauthenticated attacker can submit a specially crafted checkout POST request to inject arbitrary web scripts that execute in the context of users viewing the injected pages. This vulnerability has a CVSS 3.1 score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the affected user. The vulnerability affects confidentiality and integrity but does not impact availability.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling or restricting use of the Custom Payment Gateways for WooCommerce plugin versions up to 2.1.0. Implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the 'alg_wc_cpg_input_fields' parameter may provide temporary mitigation.