CVE-2026-103071
Received Received - Intake

Code Injection in VillaTheme Thank You Page Customizer for WooCommerce

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-103071
EUVD
EUVD-2026-96379

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
VillaTheme Thank You Page Customizer for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a code injection vulnerability in the VillaTheme Thank You Page Customizer for WooCommerce plugin. It allows attackers to inject malicious or unwanted content into web pages without authentication. The flaw exists in versions up to 1.2.3 and was patched in version 1.2.4.

Detection Guidance

Check if the WooCommerce Thank You Page Customizer plugin version is 1.2.3 or earlier. Inspect WordPress admin pages for unauthorized content changes or injected scripts. Use security plugins like Patchstack for automated detection.

Impact Analysis

Attackers could inject ads, scams, or malware links into your website pages. This could damage your site's reputation, mislead visitors, or spread malware to users. The vulnerability has a CVSS score of 7.5, indicating a high risk of exploitation.

Compliance Impact

This vulnerability allows attackers to inject unwanted content, such as ads or malware links, into pages without authentication. While the provided text does not explicitly link this to GDPR or HIPAA compliance, unauthorized code injection could potentially lead to data breaches or unauthorized access, which may violate these regulations depending on the data processed.

Mitigation Strategies

Update the plugin to version 1.2.4 or later immediately. If updating is not possible, use a web application firewall or security plugin like Patchstack to block exploitation attempts until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart