CVE-2026-66697 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in the Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin affecting versions up to 2.10.0. The vulnerability permits remote attackers to inject and execute malicious scripts in users' browsers, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data due to script execution in the victim's browser context. This can result in actions such as session hijacking, defacement, or other malicious activities within the scope of the web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor vendor communications for updates and consider applying any forthcoming patches promptly.