# Checkout Files Upload for WooCommerce <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Uploaded Files

- **ID:** WPSEC-2026-2646
- **Plugin:** Checkout Files Upload for WooCommerce (`checkout-files-upload-woocommerce`), https://wordpress.org/plugins/checkout-files-upload-woocommerce/
- **Affected versions:** from 2.0.1 before 2.4.1
- **Fixed in:** 2.4.1 (Update to 2.4.1 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/checkout-files-upload-woocommerce
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2646/

## Description

The Checkout Files Upload for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded checkout files in all versions up to, and including, 2.4.0, due to the upload handler validating only the file extension and the file view handler serving uploaded files inline with a Content-Type detected from the file contents, without nosniff or sandboxing headers. This makes it possible for unauthenticated attackers to upload a file with an allowed extension (such as .png) that contains HTML markup, which executes arbitrary web scripts in the site's origin when an administrator or shop manager opens the uploaded file from the order screen.

## References

- https://wpsec.com/vuln/WPSEC-2026-2646/
- https://plugins.svn.wordpress.org/checkout-files-upload-woocommerce/tags/2.4.1/
- https://wordpress.org/plugins/checkout-files-upload-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2646/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.