CVE-2026-66605: WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Swatchly – WooCommerce Variation Swatches for Productsto a version that resolves this vulnerability.Fixed in 1.4.14
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
Swatchly – WooCommerce Variation Swatches for Products versions 1.4.13 and earlier are identified as affected. The provided data does not state whether any specific WordPress or WooCommerce configuration is required.
What impact can successful exploitation have?
Successful XSS can affect confidentiality, integrity, and availability, each with low impact. Because the scope is changed, the impact may extend beyond the vulnerable component's own security authority.