{
 "id": "WPSEC-2026-2646",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2646/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2646/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2646/index.md",
 "title": "Checkout Files Upload for WooCommerce <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Uploaded Files",
 "description": "The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded checkout files in all versions up to, and including, 2.4.0, due to the upload handler validating only the file extension and the file view handler serving uploaded files inline with a Content-Type detected from the file contents, without nosniff or sandboxing headers. This makes it possible for unauthenticated attackers to upload a file with an allowed extension (such as .png) that contains HTML markup, which executes arbitrary web scripts in the site's origin when an administrator or shop manager opens the uploaded file from the order screen.",
 "plugin": {
  "slug": "checkout-files-upload-woocommerce",
  "name": "Checkout Files Upload for WooCommerce",
  "full_name": "Checkout Files Upload for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/checkout-files-upload-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/checkout-files-upload-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/checkout-files-upload-woocommerce"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.1",
    "from_inclusive": true,
    "to": "2.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.1 before 2.4.1"
  ]
 },
 "introduced_in": "2.0.1",
 "fixed_in": "2.4.1",
 "remediation": "Update to 2.4.1 or later.",
 "fix_released": "2026-11-05T11:16:16+00:00",
 "published": "2026-11-06T12:43:54+00:00",
 "updated": "2026-11-06T12:02:43.911656+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2646/",
  "https://plugins.svn.wordpress.org/checkout-files-upload-woocommerce/tags/2.4.1/",
  "https://wordpress.org/plugins/checkout-files-upload-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/checkout-files-upload-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}