CVE-2026-66605: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in HasThemes Swatchly – WooCommerce Variation Swatches for Products

This vulnerability, identified as CWE-79, exists in Swatchly – WooCommerce Variation Swatches for Products versions up to 1.4.13. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks by injecting malicious input that is not properly neutralized during web page generation. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation could lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider applying temporary mitigations such as input validation or disabling the vulnerable plugin if feasible.