XSS in Themehigh Checkout Field Editor (Checkout Manager) For Woocommerce
CVE-2026-3231
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in al…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (35.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/df406e59-94d9-4704-82a3-02c2c…
- plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/blo…
- plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/inc…
- plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/blo…
- plugins.trac.wordpress.org/changeset
- research.cleantalk.org/cve-2026-3231/
Frequently asked questions
- What is CVE-2026-3231?
- CVE-2026-3231 is a high-severity vulnerability in Themehigh Checkout Field Editor (Checkout Manager) For Woocommerce, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-03-11.
- How severe is CVE-2026-3231?
- High severity. CVSS v3 base score is 7.2 out of 10.