Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce… (CVE-2026-109701)

The vulnerability identified as CVE-2026-109701 is a Reflected Cross-site Scripting (XSS) issue in the PAYCOMET for WooCommerce plugin (paytpv-for-woocommerce). It arises from improper neutralization of input during web page generation, which can allow an attacker to inject and execute arbitrary scripts in the context of a victim's browser session. This affects versions up to and including 5.45. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates that the attack can be performed remotely over the network with low complexity, requires no privileges but does require user interaction, and impacts confidentiality, integrity, and availability to a limited degree.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The reflected nature means the attack requires a user to interact with a crafted link or input.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts.