AIKIDO-2026-11082
globalpayments/php-sdk is vulnerable to Cross-Site Scripting (XSS)
35
Low Risk
This Affects:
globalpayments/php-sdkTL;DR
Affected versions are vulnerable to Cross-Site Scripting (XSS) in the hosted payment page installments filtering example. The example concatenates the pay-by-link URL returned in the API response directly into an HTML anchor tag without context-aware escaping, so attacker-influenced URL content can break out of the attribute and be interpreted as markup or script when the example code is reused in a web context. The patched version routes the URL through htmlspecialchars with ENT_QUOTES before rendering, treating the value as data rather than markup.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
globalpayments/php-sdk is vulnerable to Cross-Site Scripting (XSS) in versions 14.1.3 - 14.1.15.
How to fix this
Upgrade the globalpayments/php-sdk library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant