CVE-2026-66707

HighCVSS 7.1

Published: 06/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in Facebook for WooCommerce plugin up to version 3.7.5, allowing an unauthenticated attacker to inject malicious scripts into pages.

Risk Assessment

An attacker can steal user data such as sessions or cookies, potentially leading to account takeover or malware distribution.

Recommendation

Update the Facebook for WooCommerce plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Facebook for WooCommerce

CVE-2026-49059Medium
The Facebook for WooCommerce plugin contains an Open Redirect vulnerability that enables phishing attacks. The issue affects versions from n/a through 3.7.0.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS