Checkout Files Upload for WooCommerce <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Uploaded Files
- ID
- WPSEC-2026-2646
- Plugin
- Checkout Files Upload for WooCommerce (checkout-files-upload-woocommerce)
- Affected
- from 2.0.1 before 2.4.1
- Remediation
- Update to 2.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- Checkout Files Upload for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded checkout files in all versions up to, and including, 2.4.0, due to the upload handler validating only the file extension and the file view handler serving uploaded files inline with a Content-Type detected from the file contents, without nosniff or sandboxing headers. This makes it possible for unauthenticated attackers to upload a file with an allowed extension (such as .png) that contains HTML markup, which executes arbitrary web scripts in the site's origin when an administrator or shop manager opens the uploaded file from the order screen.
References
- https://wpsec.com/vuln/WPSEC-2026-2646/
- https://plugins.svn.wordpress.org/checkout-files-upload-woocommerce/tags/2.4.1/
- https://wordpress.org/plugins/checkout-files-upload-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS