Unauthenticated Cross Site Scripting (XSS) is present in GlobalPayments WooCommerce plugin versions 1.23.3 and earlier. The flaw allows an attacker to inject arbitrary JavaScript into the plugin pages, which is executed in the browser of any user who views the affected content. This can lead to session hijacking, credential theft, or defacement of the site. The weakness is a classic reflected input sanitization issue identified as CWE-79.

Vendors affected are Global Payments, specifically the GlobalPayments WooCommerce WordPress plugin. The vulnerability applies to all releases up to and including version 1.23.3. Users running these versions should verify the installed plugin version against this list.

The CVSS score of 7.1 indicates a medium to high severity. Because EPSS data is unavailable and the vulnerability is not in the CISA KEV catalog, the known exploitation risk is moderate but could be higher if attackers focus on WordPress sites utilizing this plugin. The attack vector is inferred to be web-based and unauthenticated, as the description states that no authentication is required to trigger the XSS. An attacker could exploit the flaw simply by visiting a maliciously crafted URL or by embedding payloads in data processed by the plugin.