CVE-2026-3231

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3231", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-25T21:30:41.083Z", "datePublished": "2026-03-11T09:25:44.592Z", "dateUpdated": "2026-04-08T17:28:28.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:28.755Z"}, "affected": [{"vendor": "themehigh", "product": "Checkout Field Editor (Checkout Manager) for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page."}], "title": "Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df406e59-94d9-4704-82a3-02c2c1773c82?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block-order-data.php#L437"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/includes/utils/class-thwcfd-utils.php#L476"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block.php#L388"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3478914%40woo-checkout-field-editor-pro%2Ftrunk&old=3454287%40woo-checkout-field-editor-pro%2Ftrunk&sfp_email=&sfph_mail=#file1"}, {"url": "https://research.cleantalk.org/cve-2026-3231/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2026-03-10T21:13:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T13:25:54.947751Z", "id": "CVE-2026-3231", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:26:48.463Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3231", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T13:25:54.947751Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:26:42.518Z"}}], "cna": {"title": "Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "themehigh", "product": "Checkout Field Editor (Checkout Manager) for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.1.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-10T21:13:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df406e59-94d9-4704-82a3-02c2c1773c82?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block-order-data.php#L437"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/includes/utils/class-thwcfd-utils.php#L476"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block.php#L388"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3478914%40woo-checkout-field-editor-pro%2Ftrunk&old=3454287%40woo-checkout-field-editor-pro%2Ftrunk&sfp_email=&sfph_mail=#file1"}, {"url": "https://research.cleantalk.org/cve-2026-3231/"}], "descriptions": [{"lang": "en", "value": "The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:28.755Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3231", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:28.755Z", "dateReserved": "2026-02-25T21:30:41.083Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T09:25:44.592Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Checkout Field Editor (Checkout Manager) for WooCommerce", "vendor": "themehigh", "versions": [{"lessThanOrEqual": "2.1.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page."}, {"lang": "es", "value": "El plugin Checkout Field Editor (Checkout Manager) para WooCommerce para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de valores de campo personalizados de tipo radio y checkboxgroup enviados a trav\u00e9s de la API de la tienda de pago por bloques de WooCommerce en todas las versiones hasta la 2.1.7, inclusive. Esto se debe al m\u00e9todo `prepare_single_field_data()` en `class-thwcfd-block-order-data.php` que primero escapa los valores con `esc_html()` y luego revierte inmediatamente el escape con `html_entity_decode()` para los tipos de campo radio y checkboxgroup, combinado con una lista de permitidos `wp_kses()` permisiva en `get_allowed_html()` que permite expl\u00edcitamente el elemento `` con el atributo gestor de eventos `onchange`. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios a trav\u00e9s del endpoint de pago de la API de la tienda que se ejecutan cuando un administrador ve la p\u00e1gina de detalles del pedido."}], "id": "CVE-2026-3231", "lastModified": "2026-06-17T10:43:15.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3231", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T13:25:54.947751Z", "version": "2.0.3"}}]}, "published": "2026-03-11T10:16:13.873", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block-order-data.php#L437"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block.php#L388"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/includes/utils/class-thwcfd-utils.php#L476"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3478914%40woo-checkout-field-editor-pro%2Ftrunk&old=3454287%40woo-checkout-field-editor-pro%2Ftrunk&sfp_email=&sfph_mail=#file1"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2026-3231/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df406e59-94d9-4704-82a3-02c2c1773c82?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.7]"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "Checkout Field Editor (Checkout Manager) for WooCommerce", "source": "cna", "vendor": "themehigh"}, "product": "checkout_field_editor_for_woocommerce", "vendor": "themehigh"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T16:35:02.534875+00:00", "value": {"mitigation_remediation": ["Check the plugin vendor\u2019s website or the WordPress repository for an update to Checkout Field Editor (Checkout Manager) for WooCommerce that addresses the stored XSS flaw and upgrade immediately.", "If an immediate update cannot be applied, disable or delete the custom radio and checkboxgroup fields that allow arbitrary input, or deactivate the plugin entirely to prevent further injection of malicious scripts.", "As a temporary safeguard, implement web\u2011application firewall rules or additional input\u2011validation logic to block disallowed HTML tags and attributes in checkout submissions until a patch can be applied."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting that can execute scripts in admin context"}, "threat_synthesis": {"affected_systems": "Any WordPress site running the themehigh \u201cCheckout Field Editor (Checkout Manager) for WooCommerce\u201d plugin in a version up to and including 2.1.7 is affected. No other vendors or products are listed, so the vulnerability is limited to this specific plugin and its older releases.", "description_and_impact": "The Checkout Field Editor plugin (WooCommerce <= 2.1.7) contains a flaw in the prepare_single_field_data() function. Custom radio and checkboxgroup field values are escaped with esc_html() but immediately reversed with html_entity_decode(), and the get_allowed_html() function permits the &lt;select&gt; element with an onchange handler. This combination allows unauthenticated attackers to store malicious script payloads via the WooCommerce Block Checkout Store API. When an administrator later views an order details page, the injected script executes in the admin context, providing a Stored Cross\u2011Site Scripting (CWE\u201179) that could lead to session hijacking, defacement, or other malicious actions performed with administrative privileges.", "risk_and_exploitability": "The CVSS base score of 7.2 indicates a high-impact vulnerability. The EPSS score is reported as less than 1\u202f%, signifying a low current exploitation probability and indicating that widespread exploitation has not been observed. It is not present in the CISA KEV catalog. Attackers can exploit the flaw without authentication by submitting malicious values through the front\u2011end checkout process; the payload is then stored and executed when an administrator accesses the order. The exploitation effort is low, but the potential impact is significant given the administrator privilege context."}}}}, "created": "2026-03-12T10:06:06.378768+00:00", "updated": "2026-03-20T14:37:27.543855+00:00", "vendors": ["themehigh", "themehigh$PRODUCT$checkout_field_editor_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}