CVE-2026-66611

HighCVSS 7.1

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce versions up to 4.1.10. An attacker can inject malicious script without authentication.

Risk Assessment

Risk of customer data theft, session hijacking, or content manipulation on the shop site.

Recommendation

Update the Paymob for WooCommerce plugin to the latest version with the security fix.

Other vulnerabilities in Paymob for WooCommerce

CVE-2026-56025High
The Paymob for WooCommerce plugin version 4.1.2 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can exploit this flaw to gain unauthorized access to plugin functions.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.