CVE-2025-32586

WordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org

Published Apr 11, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce aba-payway-woocommerce-payment-gateway allows Reflected XSS.This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through <= 2.1.4.

Analysis

Technical impact

The ABA PayWay Payment Gateway for WooCommerce plugin includes a reflected Cross‑Site Scripting flaw that occurs when user‑controlled data is output in a web page without proper encoding. An attacker can supply malicious script content in URL parameters or form inputs that will be executed in the victim’s browser. This can lead to theft of session cookies, credential hijacking, or defacement of the website, but does not allow arbitrary code execution on the server. The weakness is identified as CWE‑79.

Affected Systems

This vulnerability affects the ABA PayWay Payment Gateway for WooCommerce plugin from any version through 2.1.4, distributed by ABA Bank. Any WordPress‑based WooCommerce store running the plugin at or below 2.1.4 is potentially exposed.

Risk and Exploitability

The issue has a CVSS score of 7.1, indicating high severity, and an EPSS score of less than 1%, indicating low exploitation probability. It is not listed in the CISA KEV catalog. The most likely attack vector is a crafted link or form that an unsuspecting user would click or submit, leading to delivery of malicious script in the victim’s session. While the flaw does not permit server‑side code execution, it remains a serious concern for user data integrity and trust.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ABA Bank

ABA PayWay Payment Gateway for WooCommerce

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.1.4

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the plugin to the latest version that contains the XSS fix.
If an immediate upgrade is not possible, enforce proper output escaping on any user‑supplied data rendered by the plugin using functions such as wp_kses or htmlspecialchars.
Review and restrict the plugin’s form and URL parameters to ensure they do not accept arbitrary script input before rendering.

Generated by OpenCVE AI on April 30, 2026 at 23:05 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-10751	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce allows Reflected XSS. This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through 2.1.3.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.353% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/aba-payway-woocommerce-payment-gateway/vulnerability/wordpress-aba-payway-payment-gateway-for-woocommerce-plugin-2-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce allows Reflected XSS. This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through 2.1.3.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce aba-payway-woocommerce-payment-gateway allows Reflected XSS.This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through <= 2.1.4.
Title	WordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.3 - Reflected Cross Site Scripting (XSS) vulnerability	WordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
References	https://patchstack.com/database/wordpress/plugin/aba-payway-woocommerce-payment-gateway/vulnerability/wordpress-aba-payway-payment-gateway-for-woocommerce-plugin-2-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/aba-payway-woocommerce-payment-gateway/vulnerability/wordpress-aba-payway-payment-gateway-for-woocommerce-plugin-2-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 11, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 11, 2025 9:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce allows Reflected XSS. This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through 2.1.3.
Title		WordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/aba-payway-woocommerce-payment-gateway/vulnerability/wordpress-aba-payway-payment-gateway-for-woocommerce-plugin-2-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`