CVE-2026-66707 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Facebook for WooCommerce versions <= 3.7.5. The vulnerability allows remote attackers to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. There is no information about available patches or vendor advisories in the provided data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting affected installations of Facebook for WooCommerce, potentially leading to theft of sensitive information, session hijacking, or other malicious actions. The impact is rated high due to the unauthenticated nature and network attack vector, but the requirement for user interaction limits the severity somewhat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying any recommended temporary mitigations from the vendor or restricting access to affected components. Monitor official channels for updates regarding patches or workarounds.