{"id":"CVE-2026-123122","kind":"vulnerability","aliases":["CVE-2026-123122"],"related":[],"title":"WooCommerce Checkout Files Upload plugin: stored XSS via disguised HTML upload","description":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is really one of its allowed image types, and serves stored uploads inline using their detected content type, allowing unauthenticated users to upload an HTML file disguised as an image that executes JavaScript in the browser of a shop manager or administrator who opens it from the order screen.\nThis is a regression of CVE-2025-4212, reintroduced in 2.4.0.","summary":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 accepts HTML files disguised as images at checkout and serves them inline. An unauthenticated visitor can plant JavaScript that runs in the browser of a shop manager or administrator who opens the file from the order screen.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkout-files-upload","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-2.4.1-or-later"],"how_to_check":"- Check the installed version of the Checkout Files Upload for WooCommerce plugin in the WordPress admin plugin list; affected versions are before `2.4.1`, and the sources say 2.4.0 reintroduced the flaw.\n- Look for uploaded checkout files in the WordPress uploads directory that are not real images.","fix":"- Checkout Files Upload for WooCommerce: upgrade to `2.4.1` or later.","status":"open","published_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:13+00:00","updated_at":"2026-11-14T07:28:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T07:28:13Z","model":"claude-haiku-5-5","output":{"fix":"- Checkout Files Upload for WooCommerce: upgrade to `2.4.1` or later.","reach":"internet","title":"WooCommerce Checkout Files Upload plugin: stored XSS via disguised HTML upload","impact":"medium","summary":"The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 accepts HTML files disguised as images at checkout and serves them inline. An unauthenticated visitor can plant JavaScript that runs in the browser of a shop manager or administrator who opens the file from the order screen.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","checkout-files-upload"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in an admin's browser, taking over the session","analyst_note":"Upgrade path is stated; no need for further analysis.ating","how_to_check":"- Check the installed version of the Checkout Files Upload for WooCommerce plugin in the WordPress admin plugin list; affected versions are before `2.4.1`, and the sources say 2.4.0 reintroduced the flaw.\n- Look for uploaded checkout files in the WordPress uploads directory that are not real images.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.4.1-or-later"],"who_is_affected":"Stores running the Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1, including 2.4.0. The risk arises because anyone can upload at checkout and staff open the files from the order screen. Sites without this plugin, or running 2.4.1 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000781,"input_tokens":4614,"output_tokens":639,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123122':14A,17A '-2025':146C '-2026':13A,16A '-4212':147C '2.4.0':150C '2.4.1':34B,81C 'accept':35B 'administr':63B,132C 'allow':96C,109C 'browser':57B,126C 'checkout':2A,19B,26B,42B,73C,90C 'checkout-files-upload':18B 'content':107C 'cve':12A,15A,145C 'detect':106C 'disguis':9A,38B,117C 'execut':122C 'file':3A,20B,27B,37B,67B,74C,87C,116C 'html':10A,36B,115C 'imag':40B,97C,120C 'inlin':46B,103C 'javascript':52B,123C 'manag':61B,130C 'one':93C 'open':65B,134C 'order':70B,138C 'packag':22B 'plant':51B 'plugin':5A,32B,79C 'realli':92C 'regress':143C 'reintroduc':148C 'run':54B 'screen':71B,139C 'serv':44B,100C 'shop':60B,129C 'store':6A,101C 'type':98C,108C 'unauthent':48B,110C 'upload':4A,11A,21B,28B,75C,88C,102C,113C 'use':104C 'user':111C 'verifi':84C 'via':8A 'visitor':49B 'woocommerc':1A,23B,30B,77C 'wordpress':24B,31B,78C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Stores running the Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1, including 2.4.0. The risk arises because anyone can upload at checkout and staff open the files from the order screen. Sites without this plugin, or running 2.4.1 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["checkoutfilesupload","medium","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123122':14A,17A '-2026':13A,16A 'checkout':2A 'cve':12A,15A 'disguis':9A 'file':3A 'html':10A 'plugin':5A 'store':6A 'upload':4A,11A 'via':8A 'woocommerc':1A 'xss':7A","search_b":"'2.4.1':34B 'accept':35B 'administr':63B 'browser':57B 'checkout':19B,26B,42B 'checkout-files-upload':18B 'disguis':38B 'file':20B,27B,37B,67B 'html':36B 'imag':40B 'inlin':46B 'javascript':52B 'manag':61B 'open':65B 'order':70B 'packag':22B 'plant':51B 'plugin':32B 'run':54B 'screen':71B 'serv':44B 'shop':60B 'unauthent':48B 'upload':21B,28B 'visitor':49B 'woocommerc':23B,30B 'wordpress':24B,31B","search_c":"'-2025':146C '-4212':147C '2.4.0':150C '2.4.1':81C 'administr':132C 'allow':96C,109C 'browser':126C 'checkout':73C,90C 'content':107C 'cve':145C 'detect':106C 'disguis':117C 'execut':122C 'file':74C,87C,116C 'html':115C 'imag':97C,120C 'inlin':103C 'javascript':123C 'manag':130C 'one':93C 'open':134C 'order':138C 'plugin':79C 'realli':92C 'regress':143C 'reintroduc':148C 'screen':139C 'serv':100C 'shop':129C 'store':101C 'type':98C,108C 'unauthent':110C 'upload':75C,88C,102C,113C 'use':104C 'user':111C 'verifi':84C 'woocommerc':77C 'wordpress':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123122","severity":null,"published_at":"2026-11-14T07:17:19+00:00","modified_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}