AIKIDO-2026-11082

TL;DR

Affected versions are vulnerable to Cross-Site Scripting (XSS) in the hosted payment page installments filtering example. The example concatenates the pay-by-link URL returned in the API response directly into an HTML anchor tag without context-aware escaping, so attacker-influenced URL content can break out of the attribute and be interpreted as markup or script when the example code is reused in a web context. The patched version routes the URL through htmlspecialchars with ENT_QUOTES before rendering, treating the value as data rather than markup.