PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-109701 PAYCOMET CVE debrief

A Cross-site Scripting (XSS) vulnerability exists in PAYCOMET for WooCommerce, affecting versions from n/a through 5.45. This issue allows for Reflected XSS. The CVE record was published on 2026-10-17T17:16:28.973Z and has not been modified since then. Defenders responsible for WooCommerce installations using PAYCOMET for WooCommerce should assess exposure and prioritize verification and remediation efforts. The vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized access or malicious activity. Further verification is needed to determine the full scope of affected versions and potential impact.

Vendor
PAYCOMET
Product
PAYCOMET for WooCommerce
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-17
Original CVE updated
2026-10-17
Advisory published
2026-10-17
Advisory updated
2026-10-17

Who should care

Defenders responsible for WooCommerce installations using PAYCOMET for WooCommerce should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-109701 is a Cross-site Scripting (XSS) vulnerability in PAYCOMET for WooCommerce, affecting versions from n/a through 5.45. Defenders should prioritize verifying exposure and remediation efforts.

  • Defenders need to verify exposure of WooCommerce installations to potential XSS attacks.
  • Successful exploitation could lead to unauthorized access or malicious activity.
  • Remediation priority is high due to the potential for reflected XSS attacks.
  • Further verification is needed to determine the full scope of affected versions and potential impact.

Technical summary

The PAYCOMET for WooCommerce plugin has a Reflected XSS vulnerability, affecting versions from n/a through 5.45. This issue occurs due to improper neutralization of input during web page generation. The vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized access or malicious activity. The issue arises from the plugin's failure to properly validate and sanitize user input, making it possible for attackers to inject malicious scripts.

Defensive priority

Defenders should prioritize verifying exposure of WooCommerce installations using PAYCOMET for WooCommerce, especially those allowing user input that could be reflected in web pages.

Recommended defensive actions

  • Verify WooCommerce installations for PAYCOMET for WooCommerce usage and assess exposure to potential XSS attacks.
  • Review and update PAYCOMET for WooCommerce to the latest version if possible.
  • Implement input validation and output encoding to prevent XSS attacks.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is needed to determine the full scope of affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-109701 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-109701

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-109701 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109701

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.