CVE-2026-123463 · Other
NO FIX YET · SEE WHAT TO DO
Checkout Files Upload for WooCommerce, a WordPress plugin by WP Wham, fails to neutralize input and allows stored cross-site scripting. An attacker can plant script that runs in the browsers of people who view the affected pages.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Checkout Files Upload for WooCommerce WordPress plugin with a version through 2.4.0 are affected. Sites without this plugin can skip it. The sources do not say whether any non-default configuration is needed.
Not affected if plugin-not-installed
Who cares self-hosted, woocommerce, wordpress
checkout-files-upload-woocommerce is installed and its version in the WordPress admin under Plugins.2.4.0)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.4.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.