CVE-2026-3231: WooCommerce Checkout Field Editor XSS Flaw

CVE-2026-3231 Overview

CVE-2026-3231 is a Stored Cross-Site Scripting (XSS) vulnerability in the Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 2.1.7. Unauthenticated attackers can inject arbitrary JavaScript through custom radio and checkboxgroup field values submitted via the WooCommerce Block Checkout Store API. The injected payload executes when an administrator views the order details page, leading to session theft, account takeover, or further compromise of the WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser context of any administrator who opens a malicious order, enabling administrator account compromise and full site takeover.

Affected Products

Checkout Field Editor (Checkout Manager) for WooCommerce — all versions up to and including 2.1.7
WordPress installations running the vulnerable plugin with WooCommerce Block Checkout enabled
Any storefront exposing the Store API checkout endpoint with the affected plugin active

Discovery Timeline

2026-03-11 - CVE-2026-3231 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-3231

Vulnerability Analysis

The vulnerability is a Stored XSS issue [CWE-79] in the plugin's handling of custom checkout field submissions through the WooCommerce Block Checkout Store API. Custom field types of radio and checkboxgroup accept attacker-controlled values during checkout. These values are persisted with the order and rendered later in the WordPress admin order details view, where the payload executes with administrator privileges.

Because the Store API checkout endpoint is reachable without authentication, any unauthenticated visitor can stage the attack by initiating a checkout containing a malicious field value. The execution context is the administrator session, so successful exploitation can pivot to plugin installation, user creation, or arbitrary PHP execution through standard WordPress administrative functionality.

Root Cause

The defect lives in the prepare_single_field_data() method inside class-thwcfd-block-order-data.php. For radio and checkboxgroup field types, the method first escapes the value with esc_html() and then immediately reverses the escaping by calling html_entity_decode() on the same string. This nullifies the sanitization step.

The issue is compounded by the get_allowed_html() allowlist used with wp_kses(), which explicitly permits the <select> element along with the onchange event handler attribute. An event handler attribute in an allowlist provides a direct path to script execution once raw HTML is reintroduced by the decode operation.

Attack Vector

An attacker submits a crafted order through the WooCommerce Store API checkout endpoint, placing a payload such as a <select onchange="..."> element into a custom radio or checkboxgroup field value. No authentication or user interaction by the attacker is required. The malicious markup is stored against the order. When an administrator opens the order in the WordPress dashboard, the decoded HTML and permitted event handler execute the attacker's JavaScript in the admin's browser session.

The vulnerability mechanism is documented in the plugin source review and changeset published on the WordPress plugin repository. See the WordPress Plugin Code Review and the WordPress Changeset Update for the corrected sanitization logic.

Detection Methods for CVE-2026-3231

Indicators of Compromise

Order records containing HTML tags or event handler attributes (<select, onchange=, <script, onerror=) in custom radio or checkboxgroup field values.
Unexpected administrator account creations, role changes, or new plugin installations shortly after an administrator viewed an order.
Outbound requests from admin browser sessions to unfamiliar domains immediately after opening an order details page.

Detection Strategies

Inspect the wp_postmeta and order metadata tables for stored values matching HTML or JavaScript patterns in fields managed by the Checkout Field Editor plugin.
Review WooCommerce Store API access logs for checkout submissions containing encoded tag characters (%3Cselect, %3Cscript) in custom field parameters.
Correlate administrator dashboard sessions with anomalous JavaScript-initiated actions such as user creation, option changes, or plugin uploads.

Monitoring Recommendations

Alert on any modification to administrator users or to the active_plugins option that occurs within minutes of an admin viewing an order page.
Monitor web server logs for POST requests to /wp-json/wc/store/v1/checkout containing suspicious payload markers.
Track plugin version inventory across WordPress sites to identify hosts still running Checkout Field Editor 2.1.7 or earlier.

How to Mitigate CVE-2026-3231

Immediate Actions Required

Update the Checkout Field Editor (Checkout Manager) for WooCommerce plugin to the version published after 2.1.7 that includes the fix referenced in the WordPress changeset.
Audit existing orders for stored HTML or scripting content in custom radio and checkboxgroup field values and sanitize or remove offending records.
Rotate administrator credentials and invalidate active sessions if administrators have viewed orders since the plugin was installed.

Patch Information

The vendor released a fix tracked in the WordPress Changeset Update. The patch removes the html_entity_decode() reversal after esc_html() for radio and checkboxgroup field types and tightens the wp_kses() allowlist returned by get_allowed_html(). Additional analysis is available in the Wordfence Vulnerability Report and the CleanTalk CVE-2026-3231 Analysis.

Workarounds

Deactivate the Checkout Field Editor plugin until the patched version can be deployed.
Remove or disable custom radio and checkboxgroup fields from the checkout configuration to eliminate the vulnerable code path.
Place a Web Application Firewall (WAF) rule in front of the Store API checkout endpoint to block requests containing HTML tags or event handler attributes in custom field parameters.

bash

# Configuration example
# Verify the installed plugin version on a WordPress host using WP-CLI
wp plugin get woo-checkout-field-editor-pro --field=version

# Update the plugin to the latest patched release
wp plugin update woo-checkout-field-editor-pro