A vulnerability identified as problematic has been detected in corvusinfo CorvusPay WooCommerce Payment Gateway Plugin up to 2.7.4 on WordPress. This impacts an unknown function of the file /wp-json/corvuspay/success of the component approval_code Handler. The manipulation of the argument approval_code leads to cross site scripting.
This vulnerability is documented as CVE-2026-6939. The attack can be initiated remotely. There is not any exploit available.
