CVE-2026-94171

3th percentile - higher than 3% of all known CVEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS. This issue affects CURCY: 2.2.18.

An attacker can exploit the XSS vulnerability to execute malicious scripts in the victim's browser, potentially leading to data theft, session hijacking, or other harmful actions.

Update the CURCY plugin to a version that includes a fix for input neutralization, or apply temporary mitigations such as WAF filters.