CVE-2026-11324: WooCommerce Placetopay XSS Vulnerability

CVE-2026-11324 Overview

CVE-2026-11324 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the WooCommerce PlacetoPay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress. The flaw exists in versions up to and including 3.2.2 and stems from insufficient input sanitization and output escaping of the redirect-url parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the user clicks a crafted link. The vulnerability is tracked under [CWE-79] and disclosed through the Wordfence Vulnerability Analysis.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's session, enabling credential theft, session hijacking, and administrative account takeover on affected WooCommerce stores.

Affected Products

WooCommerce PlacetoPay Gateway plugin for WordPress (versions ≤ 3.2.2)
PlacetoPay/AvalPay Gateway plugin for WordPress (versions ≤ 3.2.2)
WordPress sites using the PlacetoPay payment integration for WooCommerce checkout

Discovery Timeline

2026-07-17 - CVE-2026-11324 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-11324

Vulnerability Analysis

The vulnerability resides in the request handling logic of GatewayMethod.php, the primary gateway class that processes checkout and redirect flows for the PlacetoPay integration. The plugin reads the redirect-url parameter from HTTP requests and reflects that value back into rendered output without sufficient sanitization or escaping. Because the reflection occurs in an HTML context, attacker-controlled payloads execute as JavaScript in the victim's browser.

Relevant code paths appear at GatewayMethod.php line 600, line 718, line 1824, and line 1852. These locations handle post-payment redirection state where the parameter should be validated as a URL and encoded before rendering.

Root Cause

The root cause is missing input validation combined with absent output escaping on the redirect-url parameter. WordPress provides functions such as esc_url(), esc_attr(), and wp_kses() for context-appropriate encoding, none of which were applied on the reflected value. As a result, characters such as <, >, and " pass through unchanged into the HTML response.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL targeting a vulnerable endpoint on the WooCommerce store and appends a malicious redirect-url value containing a script payload. The attacker delivers the link via phishing email, social media, or a malicious site. When a logged-in administrator or shopper clicks the link, the payload executes in their session, allowing the attacker to steal cookies, perform actions on behalf of the user, or pivot to further compromise.

The vulnerability manifests when the redirect-url query parameter is reflected into HTML output. Attackers deliver a specially crafted URL containing JavaScript in the parameter value. See the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-11324

Indicators of Compromise

Web server access logs containing requests with redirect-url parameter values including <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers from unfamiliar external domains preceding requests to WooCommerce checkout or PlacetoPay callback endpoints.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking marketing or transactional links.
New or modified WordPress administrator accounts, plugins, or theme files following administrator link clicks.

Detection Strategies

Search HTTP request logs for the redirect-url parameter containing script tags, event handlers, or encoded angle brackets.
Deploy a Web Application Firewall (WAF) rule to flag reflected XSS patterns targeting WooCommerce and PlacetoPay endpoints.
Correlate administrator authentication events with subsequent session-token-bearing requests originating from unusual IP addresses or user agents.
Review browser Content Security Policy (CSP) reports for blocked inline script executions on checkout-related pages.

Monitoring Recommendations

Enable verbose logging on all WooCommerce checkout and payment callback URLs, retaining full query strings.
Monitor plugin file integrity for GatewayMethod.php and other files under the woocommerce-gateway-placetopay directory.
Alert on WordPress administrator sessions initiated from geographies or ASNs outside expected baselines.

How to Mitigate CVE-2026-11324

Immediate Actions Required

Upgrade the WooCommerce PlacetoPay Gateway plugin to a version later than 3.2.2 once released by the vendor. Track updates via the plugin release page.
If no fixed version is available, deactivate the plugin on production WordPress sites until a patch is published.
Force a password reset and terminate active sessions for all WordPress administrator accounts on affected sites.
Review recent administrator activity, plugin installations, and user creation events for signs of exploitation.

Patch Information

The current published release at the time of disclosure is v3.2.2, which remains vulnerable. Administrators should monitor the PlacetoPay GitHub repository and the Wordfence Vulnerability Analysis for the release addressing this issue. The fix should apply esc_url() and esc_attr() to the redirect-url parameter before reflection.

Workarounds

Deploy WAF rules that block requests containing <, >, ", or javascript: inside the redirect-url parameter on WooCommerce endpoints.
Enforce a strict Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins.
Restrict WordPress administrator access to specific IP ranges via .htaccess or reverse proxy rules to reduce the impact of session hijacking.
Educate staff handling store administration to avoid clicking unsolicited links referencing checkout, payment, or redirect URLs.

bash

# Example WAF/ModSecurity rule blocking script payloads in redirect-url parameter
SecRule ARGS:redirect-url "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1026113240,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'CVE-2026-11324 - Reflected XSS attempt in PlacetoPay redirect-url parameter'"