CVE-2026-66711

HighCVSS 7.1

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

Risk Assessment

The risk includes the possibility of executing malicious scripts in the victim's browser, which could lead to session theft, account takeover, or other attacks. The attack requires subscriber privileges, but can be carried out by anyone with such an account.

Recommendation

It is recommended to update the WooCommerce Multilingual & Multicurrency plugin to the latest version that contains the fix. Also, consider applying input and output filters.

Other vulnerabilities in WooCommerce Multilingual & Multicurrency

CVE-2026-62130High
The WooCommerce Multilingual & Multicurrency plugin in versions up to and including 5.5.8 contains a PHP Object Injection flaw exploitable by a shop manager user. This may lead to dangerous code execution or further privilege escalation.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS