This vulnerability is a reflected Cross‑Site Scripting flaw caused by improper neutralization of user input during page rendering in the PAYCOMET for WooCommerce plugin. Attackers can inject arbitrary JavaScript that runs in the browser of any visitor who views a modified page, enabling session hijacking, credential theft, defacement, or the execution of further malicious payloads. The weakness corresponds to CWE‑79 and can compromise confidentiality, integrity, and availability of user sessions.

The PAYCOMET for WooCommerce WordPress plugin versions up to and including 5.45 are affected. This includes all installations of the plugin on WordPress sites that have not applied the latest release beyond 5.45. No specific environment or server version is mentioned, so any WordPress site using these plugin versions is vulnerable.

The CVSS score of 7.1 indicates a high severity reflected XSS. EPSS is not available, so the probability of active exploitation is uncertain, but the lack of a KEV listing suggests no known widespread exploitation. The likely attack vector is a crafted link or form that collects user input, which when reflected by the plugin will execute in the victim's browser. Users who click such a link or submit a malicious form could have their session hijacked or be infected by malware.