CVE-2026-123463: WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Q: What access does an attacker need to exploit this issue?

The vulnerability is network-reachable and requires no attacker privileges. Exploitation does require user interaction.

Q: Which installations should be considered affected?

Checkout Files Upload for WooCommerce versions through 2.4.0 are affected. The provided data does not identify an unaffected fixed version.

Q: What is the potential impact if exploitation succeeds?

The issue is a stored XSS vulnerability with low confidentiality, integrity, and availability impact. Its scope is changed, meaning the impact may extend beyond the vulnerable component's security authority.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.4.0.

Affected Software

1 affected component

WP Wham Checkout Files Upload for WooCommerce<=2.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Wham Checkout Files Upload for WooCommerce to a version that resolves this vulnerability.
Fixed in 2.4.1

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is network-reachable and requires no attacker privileges. Exploitation does require user interaction.

Which installations should be considered affected?

Checkout Files Upload for WooCommerce versions through 2.4.0 are affected. The provided data does not identify an unaffected fixed version.

What is the potential impact if exploitation succeeds?

The issue is a stored XSS vulnerability with low confidentiality, integrity, and availability impact. Its scope is changed, meaning the impact may extend beyond the vulnerable component's security authority.

CVE-2026-123463: WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which installations should be considered affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which installations should be considered affected?

What is the potential impact if exploitation succeeds?