CVE-2026-11324

MEDIUM

WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'

Title source: cna

Description

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

References (8)

Core 8

Core References

https://github.com/placetopay/woocommerce-gateway-placetopay/blob/3.2.2/src/GatewayMethod.php#L1852

View Writeup ZIP pw:eip

https://evertecinc.com/en/solution/placetopay/

https://github.com/placetopay/woocommerce-gateway-placetopay/blob/3.2.2/src/GatewayMethod.php#L718

View Writeup ZIP pw:eip

https://github.com/placetopay/woocommerce-gateway-placetopay/blob/3.2.2/src/GatewayMethod.php#L1824

View Writeup ZIP pw:eip

https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca87868-357b-4d71-9bf9-cd3b15b2555d?source=cve

https://banco.santander.cl/uploads/000/049/181/1705c2cf-fc73-4fc4-a29d-f56f3ea88103/original/woocommerce-gateway-placetopay-2_24_1-php-8_x.zip

https://github.com/placetopay/woocommerce-gateway-placetopay/releases/tag/3.2.2

https://github.com/placetopay/woocommerce-gateway-placetopay/blob/3.2.2/src/GatewayMethod.php#L600

View Writeup ZIP pw:eip

Scores

CVSS v3 6.1

EPSS 0.0028

EPSS Percentile 20.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (6)

evertec/WooCommerce Placetopay Gateway < 3.2.2

evertec/WooCommerce Placetopay Gateway Belice < 3.2.2

evertec/WooCommerce Placetopay Gateway Colombia < 3.2.2

evertec/WooCommerce Placetopay Gateway Ecuador < 3.2.2

evertec/WooCommerce Placetopay Gateway Honduras < 3.2.2

evertec/WooCommerce Placetopay Gateway Uruguay < 3.2.2

Published Jul 17, 2026

Tracked Since Jul 17, 2026