CVE-2026-57402
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Flexible Refund and Return Order for WooCommerce plugin up to version 1.0.51 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.
Risk Assessment
The risk includes session hijacking, admin account takeover, content manipulation, and theft of sensitive data, potentially compromising the WooCommerce store's security and customer trust.
Recommendation
Immediately update the Flexible Refund and Return Order for WooCommerce plugin to a version higher than 1.0.51, which includes a fix for the XSS vulnerability.
Other vulnerabilities in Flexible Refund and Return Order for WooCommerce
See all- CVE-2025-12621Medium
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
- CVE-2025-10570Medium
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers with subscriber-level access and above to submit refund requests for arbitrary orders that they do not own.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from n/a through <= 1.0.51.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS