CVE-2026-66475: WooCommerce Checkout Manager XSS Flaw

CVE-2026-66475 Overview

CVE-2026-66475 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Checkout Field Editor for WooCommerce – Checkout Manager plugin for WordPress. The flaw affects plugin versions up to and including 3.0.5. An authenticated user with Shop Manager privileges can inject malicious script content that executes in the browsers of other users interacting with affected checkout fields. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-07-27.

Critical Impact
A Shop Manager can inject stored JavaScript into checkout configuration, potentially compromising administrator sessions and customer data on affected WooCommerce stores.

Affected Products

Checkout Field Editor for WooCommerce – Checkout Manager plugin (WordPress)
Plugin versions <= 3.0.5
WooCommerce storefronts using the affected plugin

Discovery Timeline

2026-07-27 - CVE-2026-66475 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66475

Vulnerability Analysis

The Checkout Field Editor for WooCommerce – Checkout Manager plugin allows Shop Manager accounts to configure checkout form fields. The plugin fails to properly sanitize or encode user-supplied input within field configuration parameters. An attacker holding Shop Manager credentials can store JavaScript payloads inside checkout field attributes. When administrators or customers render the affected pages, the browser executes the injected script under the site's origin.

The vulnerability changes scope, meaning injected script can affect users beyond the attacker's own privilege boundary. This makes the flaw useful for lateral privilege escalation against site administrators. User interaction is required for the payload to trigger, typically through viewing a checkout page or plugin settings screen.

Root Cause

The root cause is missing output encoding and insufficient input validation on checkout field configuration values managed through the plugin's administrative interface. Values persisted by Shop Manager accounts are rendered without escaping HTML metacharacters, enabling stored XSS [CWE-79].

Attack Vector

Exploitation requires network access to the WordPress admin interface and authenticated access at the Shop Manager role or higher. The attacker submits crafted input through the plugin's field configuration forms. A second user, typically an administrator or customer, must then load a page that renders the poisoned field for the payload to execute.

No verified proof-of-concept code has been published. Refer to the Patchstack WooCommerce XSS Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-66475

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs stored in WooCommerce checkout field configuration records.
New or modified WordPress administrator accounts following Shop Manager activity.
Outbound requests from administrator browsers to unknown domains after visiting checkout or plugin settings pages.

Detection Strategies

Audit the wp_options and plugin-specific database tables for checkout field values containing HTML or JavaScript syntax.
Review WordPress audit logs for edits to checkout field configurations by Shop Manager accounts.
Inspect web server access logs for POST requests to the plugin's settings endpoints followed by suspicious admin-side activity.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record configuration changes made by Shop Manager users.
Deploy a Web Application Firewall (WAF) rule set that flags script tags and event handlers in checkout field parameters.
Monitor Content Security Policy (CSP) violation reports for inline script executions on /wp-admin/ and checkout pages.

How to Mitigate CVE-2026-66475

Immediate Actions Required

Update the Checkout Field Editor for WooCommerce – Checkout Manager plugin to a version newer than 3.0.5 once the vendor publishes a fixed release.
Review and restrict which accounts hold the Shop Manager role; remove the role from users who do not require it.
Audit existing checkout field configurations for stored HTML or script content and remove any unexpected payloads.

Patch Information

Consult the Patchstack WooCommerce XSS Vulnerability advisory for the current patched version and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Temporarily deactivate the Checkout Field Editor for WooCommerce – Checkout Manager plugin if a patched version is not yet available.
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and checkout pages.
Require multi-factor authentication for all accounts with Shop Manager or higher privileges to limit abuse of compromised credentials.

bash

# Example: apply a restrictive Content Security Policy header in nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;