Woo Checkout Field Editor Pro Vulnerabilities

Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field vulnerability

CVSS:

7.1

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Mar 12, 2026

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_...

CVSS:

7.2

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Mar 10, 2026

CVE-2026-3231 on NVD →

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic...

CVSS:

4.7

Affected:

up to 2.0.3

Fixed in:

2.0.4

Disclosed:

Oct 3, 2024

CVE-2024-8499 on NVD →

The Checkout Field Editor plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.7.2 via deserialization of untrusted input from the 'save_plugin_settings' function and the 'i_settings_data' parameter. This allows administrator-level attackers to inject a PHP Object. No POP chain...

CVSS:

8

Affected:

up to 1.7.2

Fixed in:

1.8.0

Disclosed:

Nov 7, 2022

CVE-2022-3490 on NVD →