Invoice Gateway for WooCommerce plugin reflected XSS

A WordPress invoice payment plugin can be tricked into running malicious scripts against visitors.

Summary

A input handling flaw in this WordPress WooCommerce invoice payment plugin lets an attacker run malicious scripts. Versions 1.1.6 and older are affected.

What to do

Update to version 1.1.7 or later. Versions 1.1.6 and older are affected.

Products and platforms

Invoice Gateway for WooCommerce – Invoice Payment Gateway

CVE IDs

CVE-2026-120856 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-09 12:09 UTC

First seen 2026-11-09 12:26 UTC