CVE-2026-66475 in Checkout Field Editor Plugin
Summary
by MITRE • 07/27/2026
Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability exists within the Checkout Manager plugin for WooCommerce, specifically affecting versions up to and including 3.0.5. The issue manifests as a cross site scripting flaw in the Checkout Field Editor component that allows authenticated attackers with shop manager privileges to inject malicious scripts into checkout form fields. The vulnerability stems from insufficient input sanitization and output escaping mechanisms within the plugin's administrative interface where shop managers can modify checkout field configurations.
The technical implementation of this XSS vulnerability occurs when the plugin fails to properly sanitize user inputs submitted through the checkout field editor interface. When a shop manager saves modified field configurations, the plugin does not adequately filter or escape special characters that could be interpreted as executable script code by web browsers. This allows an attacker with sufficient privileges to inject malicious javascript payloads that execute in the context of other administrators or customers who view the affected checkout pages.
The operational impact of this vulnerability is significant for e-commerce platforms using affected versions of the plugin. An attacker with shop manager access can potentially steal session cookies, perform actions on behalf of other users, redirect customers to malicious sites, or extract sensitive information from checkout forms. The attack vector requires only that an attacker possess valid shop manager credentials, which may be obtained through social engineering, credential compromise, or insider threats. This vulnerability directly maps to CWE-79 - Cross-site Scripting and aligns with ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment.
Mitigation strategies should focus on immediate plugin updates to versions that address the XSS vulnerability, as well as implementing additional security controls such as role-based access restrictions, input validation hardening, and regular security audits of administrative interfaces. Organizations should also consider network-level protections including web application firewalls and monitoring for suspicious administrative activities. The vulnerability underscores the importance of proper output encoding and input validation practices in web applications, particularly within administrative interfaces where privileged users can modify core system configurations.