CVE-2026-123122: Checkout Files Upload for WooCommerce 2.4.0 - Unauthenticated Stored XSS via Uploaded File
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is really one of its allowed image types, and serves stored uploads inline using their detected content type, allowing unauthenticated users to upload an HTML file disguised as an image that executes JavaScript in the browser of a shop manager or administrator who opens it from the order screen. This is a regression of CVE-2025-4212, reintroduced in 2.4.0.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WooCommerce stores using Checkout Files Upload for WooCommerce version 2.4.0 are exposed. The attacker does not need to authenticate, but the stored script executes only when a shop manager or administrator opens the uploaded file from the order screen.
What does an attacker need to do to exploit it?
An attacker needs to submit a checkout upload containing an HTML file disguised as an allowed image type. The plugin does not verify that the upload is actually an allowed image type and serves the stored file inline using its detected content type.
Is this present in earlier versions of the plugin?
The provided information identifies version 2.4.0 as affected and states that versions before 2.4.1 are vulnerable. It also describes the issue as a regression of CVE-2025-4212 that was reintroduced in 2.4.0.