CVE-2026-66475 is a CWE-79 Cross-Site Scripting vulnerability affecting the Checkout Field Editor for WooCommerce – Checkout Manager plugin versions up to and including 3.0.5. The flaw arises from improper neutralization of input during web page generation, allowing a shop manager with high privileges to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity, with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability in a limited manner. No official patch or remediation level has been confirmed as of the published date.

The vulnerability allows a shop manager with high privileges to execute cross-site scripting attacks, potentially leading to limited confidentiality, integrity, and availability impacts within the affected WooCommerce environment. This could enable script injection that affects users interacting with the checkout fields, but exploitation requires high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager privileges carefully and avoid granting unnecessary permissions. Monitor vendor channels for updates and apply patches promptly once released.