Stored Cross-Site Scripting in WooCommerce Checkout Field Editor by WordPress

CVE-2026-3231

What is CVE-2026-3231?

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting, which allows attackers to inject malicious scripts. This vulnerability arises when custom radio and checkbox group field values are submitted through the WooCommerce Block Checkout Store API without adequate validation. Specifically, the prepare_single_field_data() method inadequately handles input by first escaping values and then reversing that escaping, posing risks when an administrator views order details. Unauthenticated attackers can exploit this flaw via the Store API checkout endpoint, potentially compromising sensitive information and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References