The HBLPAY Payment Gateway for WooCommerce plugin is vulnerable to a reflected Cross‑Site Scripting flaw that enables an unauthenticated attacker to insert arbitrary scripts via the cusdata parameter. When a victim receives a URL containing malicious data in that parameter, the plugin echoes the value back to the page without sufficient sanitization or escaping, causing the browser to execute the injected code. The CVE description does not detail additional consequences beyond client‑side script execution.

The vulnerability exists in all HBLPAY Payment Gateway for WooCommerce releases up to and including version 5.0.0. Sites that use any of those versions are affected; newer versions released after 5.0.0 are assumed to have addressed the issue.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. Based on the description, the likely attack vector is an unauthenticated user constructing a URL with malicious payload for the cusdata parameter and persuading a victim to click it. The flaw is not listed in the CISA KEV catalog, but it remains a client‑side vulnerability that should be mitigated.