CVE-2026-103071
HighCVSS 7.5Summary
Code injection vulnerability in the Thank You Page Customizer for WooCommerce plugin. Allows code injection. Affects versions up to 1.2.3.
Risk Assessment
An attacker could inject malicious code, potentially leading to remote code execution or site takeover.
Recommendation
Update the Thank You Page Customizer plugin to the latest patched version. Restrict admin panel access and monitor logs.
Other vulnerabilities in Thank You Page Customizer for WooCommerce
See all- CVE-2026-81786High
The Thank You Page Customizer for WooCommerce plugin in versions up to and including 1.2.2 contains a broken access control flaw that allows an unauthenticated attacker to perform unauthorized operations.
- CVE-2025-66528Medium
The Thank You Page Customizer for WooCommerce plugin (versions up to and including 1.1.8) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This enables unauthorized users to perform protected operations.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS