The ABA PayWay Payment Gateway for WooCommerce plugin includes a reflected Cross‑Site Scripting flaw that occurs when user‑controlled data is output in a web page without proper encoding. An attacker can supply malicious script content in URL parameters or form inputs that will be executed in the victim’s browser. This can lead to theft of session cookies, credential hijacking, or defacement of the website, but does not allow arbitrary code execution on the server. The weakness is identified as CWE‑79.

This vulnerability affects the ABA PayWay Payment Gateway for WooCommerce plugin from any version through 2.1.4, distributed by ABA Bank. Any WordPress‑based WooCommerce store running the plugin at or below 2.1.4 is potentially exposed.

The issue has a CVSS score of 7.1, indicating high severity, and an EPSS score of less than 1%, indicating low exploitation probability. It is not listed in the CISA KEV catalog. The most likely attack vector is a crafted link or form that an unsuspecting user would click or submit, leading to delivery of malicious script in the victim’s session. While the flaw does not permit server‑side code execution, it remains a serious concern for user data integrity and trust.