Stored XSS Vulnerability in Checkout Files Upload for WooCommerce by WordPress
CVE-2026-123463

7.1HIGH

Key Information:

Vendor

WordPress
Status
Checkout Files Upload For WooCommerce
Vendor
CVE Published:
9 November 2026

What is CVE-2026-123463?

A vulnerability exists in the Checkout Files Upload for WooCommerce plugin that allows for improper neutralization of input during web page generation, leading to a Stored XSS condition. This vulnerability may permit malicious users to inject arbitrary JavaScript content into web pages viewed by other users, potentially impacting the users' experience and security. This affects versions up to 2.4.0.

Affected Version(s)

Checkout Files Upload for WooCommerce 0 <= 2.4.0

References

https://patchstack.com/database/wordpress/plugin/checkout...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

walter81 | Patchstack Bug Bounty Program
.