CVE-2026-66700

8th percentile - higher than 8% of all known CVEs

The Smart Online Order for Clover plugin version 1.6.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.

The risk includes user session theft, account takeover, displaying fake content, or redirecting to malicious sites. This could lead to compromise of user data confidentiality.

It is recommended to update the Smart Online Order for Clover plugin to a version newer than 1.6.1. Also, apply input filtering and sanitization mechanisms.