CVE-2026-7517 is a stored cross-site scripting vulnerability (CWE-79) in the Custom Payment Gateways for WooCommerce WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'alg_wc_cpg_input_fields' parameter in versions up to 2.1.0. An unauthenticated attacker can submit a specially crafted checkout POST request to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability does not require any custom input fields to be configured, increasing its attack surface.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality and integrity. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor the vendor's communications for updates and apply any released patches promptly once available. Until then, consider restricting access to affected plugin functionality or disabling the plugin if feasible.