CVE-2026-66707
Received Received - Intake

Unauthenticated XSS in Facebook for WooCommerce

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Patchstack

Description
Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-66707
EUVD
EUVD-2026-53910

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
facebook for_woocommerce to 3.7.5 (inc)
facebook facebook_for_woocommerce to 3.7.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the Facebook for WooCommerce plugin for WordPress, affecting versions 3.7.5 and below. It allows attackers to inject malicious scripts into web pages viewed by users. The vulnerability has a CVSS score of 7.1, indicating moderate severity.

Detection Guidance

Detecting this XSS vulnerability requires checking the installed version of the Facebook for WooCommerce plugin. Use WordPress admin panel to verify the plugin version or run a server scan for vulnerable versions (3.7.5 or below).

Commands: Check plugin version via WordPress dashboard or run: grep -r 'facebook-for-woocommerce' /path/to/wordpress/wp-content/plugins/ | grep 'Version:'

Impact Analysis

Attackers could exploit this to inject malicious scripts, such as redirects or advertisements, which execute when visitors access the site. Successful exploitation requires a user to click a malicious link or submit a form, potentially leading to data theft or unauthorized actions on the site.

Mitigation Strategies

Immediately update the Facebook for WooCommerce plugin to version 3.7.6 or later. If updating is not possible, apply Patchstack's mitigation rule to block attacks until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66707. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart