WordPress Plugin Vulnerabilities

Meta for WooCommerce < 3.7.6 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
facebook-for-woocommerce
Fixed in 3.7.6

References

CVE
CVE-2026-66707
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3b0e83af-5abd-4b6e-b606-850c03b05036

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
c7a40b86-f9f6-498d-81f1-f39a0d174877

Timeline

Publicly Published
2026-07-31 (about 24 days ago)
Added
2026-08-04 (about 19 days ago)
Last Updated
2026-08-04 (about 19 days ago)

Other

Published
Title
Published
2025-10-21
Title
Bg Book Publisher <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2019-07-09
Title
Gallery Photoblocks < 1.1.43 - Authenticated Reflected XSS
Published
2026-06-03
Title
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker < 11.1.3 - Unauthenticated Stored Cross-Site Scripting
Published
2025-08-20
Title
Themify Icons < 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-07-23
Title
Royal Elementor Addons and Templates < 1.3.981 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget