VulnSocial

CVE-2026-7517Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable by unauthenticated guest users submitting a crafted checkout POST request, requiring no custom input fields to be configured in the plugin.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-02); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-02: 1Mentions · 2026-08-19: 1Patch / Workaround · 2026-07-02: 1Patch / Workaround · 2026-08-19: 1Technical Details · 2026-07-02: 1Technical Details · 2026-08-19: 107-0208-19
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-07-021
Disclosure1
2026-08-191
Patch1
Full discourse2 posts
  • Joey Romaine 🇺🇸 |=★=|@Tank23x0
    Patch

    Every week brings new attack surface. CVE-2026-7517 — take a look. The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... Patch or mitigate before this gets walked into your environment.

    Post summary

    The post alerts to a stored XSS flaw in the Custom Payment Gateways for WooCommerce (CVE‑2026‑7517) and urges users to apply a patch or mitigation before the vulnerability can be exploited.

    0001044
    352 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-7517 - Stored #XSS in Custom Payment Gateways for #WooCommerce. Unauthenticated users can inject scripts via alg_wc_cpg_input_fields. #CVSS 7.2. Disable or replace immediately. #CVEAlert @WooCommerce #WordPress #infosec #developers #sysadmin #100daysofcode More info: https://www.valtersit.com/cve/CVE-2026-7517/

    Post summary

    CVE‑2026‑7517 is a stored XSS flaw in WooCommerce’s custom payment gateway, allowing unauthenticated script injection through the alg_wc_cpg_input_fields parameter; the advisory urges disabling or replacing the vulnerable component and notes a CVSS score of 7.2.

    0000064
    968 followersView on X

Explore more

Back to dashboard