CVE-2026-123122

Checkout Files Upload for WooCommerce 2.4.0 - Unauthenticated Stored XSS via Uploaded File

View on CVE.org
Published Nov 14, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is really one of its allowed image types, and serves stored uploads inline using their detected content type, allowing unauthenticated users to upload an HTML file disguised as an image that executes JavaScript in the browser of a shop manager or administrator who opens it from the order screen.
This is a regression of CVE-2025-4212, reintroduced in 2.4.0.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is really one of its allowed image types, and serves stored uploads inline using their detected content type, allowing unauthenticated users to upload an HTML file disguised as an image that executes JavaScript in the browser of a shop manager or administrator who opens it from the order screen. This is a regression of CVE-2025-4212, reintroduced in 2.4.0.
Title Checkout Files Upload for WooCommerce 2.4.0 - Unauthenticated Stored XSS via Uploaded File
References

Subscriptions

No data.

Weaknesses

No weakness.

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Nov 14, 2026, 6:00 AM
Reserved
Nov 5, 2026, 1:02 PM

View source JSON

No data.

No data.

No data.

No data.