CVE-2026-66468

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Unauthenticated Cross-Site Scripting (XSS) in Local Delivery Drivers for WooCommerce plugin versions up to 3.0.0. An attacker can inject malicious script without authentication.

Risk Assessment

Possibility to execute malicious script in the user's browser, which may lead to session theft, account takeover, or malware distribution.

Recommendation

Update the Local Delivery Drivers for WooCommerce plugin to the latest version that fixes the XSS issue.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.