CVE-2026-123122
Received Received - Intake

Stored XSS in Checkout Files Upload for WooCommerce Plugin

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: WPScan

Description
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is really one of its allowed image types, and serves stored uploads inline using their detected content type, allowing unauthenticated users to upload an HTML file disguised as an image that executes JavaScript in the browser of a shop manager or administrator who opens it from the order screen. This is a regression of CVE-2025-4212, reintroduced in 2.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-14
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-123122
EUVD
EUVD-2026-125865

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Checkout Files Upload for WooCommerce From 2.4.0 (inc) to 2.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the Checkout Files Upload for WooCommerce plugin. It allows attackers to upload malicious HTML files disguised as images during checkout. When a shop manager or administrator views the file from the order screen, the browser executes the embedded JavaScript due to improper file type verification and inline serving of uploads.

Detection Guidance

Check if the Checkout Files Upload for WooCommerce plugin is installed and verify its version. If it is version 2.4.0, it is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

Unauthenticated attackers could upload malicious files that execute JavaScript in the browsers of shop managers or administrators. This could lead to session hijacking, theft of sensitive data like payment information, or unauthorized administrative actions on the WordPress site.

Compliance Impact

This vulnerability could compromise user data privacy, potentially violating GDPR (General Data Protection Regulation) by exposing personal or payment information. For HIPAA (Health Insurance Portability and Accountability Act), it may risk protected health information if handled by the site. Compliance failures could result in legal penalties or reputational damage.

Mitigation Strategies

Update the Checkout Files Upload for WooCommerce plugin to version 2.4.1 or later immediately to patch the vulnerability. Disable file uploads at checkout if not required until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...