---
id: "CVE-2026-123122"
page: "https://infrastack.ai/live/CVE-2026-123122"
kind: "vulnerability"
aliases: ["CVE-2026-123122"]
title: "WooCommerce Checkout Files Upload plugin: stored XSS via disguised HTML upload"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["checkout-files-upload", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-2.4.1-or-later"]
published_at: "2026-11-14T07:17:19+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:28:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123122", "first_seen_at": "2026-11-14T07:27:45+00:00"}]
exploit_sources: []
---

# WooCommerce Checkout Files Upload plugin: stored XSS via disguised HTML upload

Link for people: https://infrastack.ai/live/CVE-2026-123122 (this .md is for agents)

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 accepts HTML files disguised as images at checkout and serves them inline. An unauthenticated visitor can plant JavaScript that runs in the browser of a shop manager or administrator who opens the file from the order screen.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Checkout Files Upload for WooCommerce plugin in the WordPress admin plugin list; affected versions are before `2.4.1`, and the sources say 2.4.0 reintroduced the flaw.
- Look for uploaded checkout files in the WordPress uploads directory that are not real images.

## Fix

- Checkout Files Upload for WooCommerce: upgrade to `2.4.1` or later.

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123122

## From the sources

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is really one of its allowed image types, and serves stored uploads inline using their detected content type, allowing unauthenticated users to upload an HTML file disguised as an image that executes JavaScript in the browser of a shop manager or administrator who opens it from the order screen.
This is a regression of CVE-2025-4212, reintroduced in 2.4.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_