Comment by ciaovietnam

This can happen to any shopping cart that lets shop owners add custom codes/plugins to the checkout page. Though that enhances the look and feel, I dont think it is a good idea. The checkout page should use a universal design (like Shopify's checkout page), it will reduce the chance of XSS attacks.