Cross-site scripting in ThemeHigh Checkout Field Editor for WooCommerce
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3231
- 2026-10-03 Alias added: GHSA-9prh-3fwj-8frx
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/df406e59-94d9-4704-82a3-02c2c1773c82?source=cve
- https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block-order-data.php#L437
- https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/includes/utils/class-thwcfd-utils.php#L476
- https://plugins.trac.wordpress.org/browser/woo-checkout-field-editor-pro/tags/2.1.7/block/class-thwcfd-block.php#L388
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3478914%40woo-checkout-field-editor-pro%2Ftrunk&old=3454287%40woo-checkout-field-editor-pro%2Ftrunk&sfp_email=&sfph_mail=#file1
- https://research.cleantalk.org/cve-2026-3231/
More ThemeHigh vulnerabilities
- TI-2022-03221 Checkout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object Injection CVSS 3.1HIGH 7.2
- TI-2024-00649 Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2022-00692 Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
- TI-2023-02962 Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2024-23527 Path traversal in ThemeHigh Checkout Field Editor for WooCommerce CVSS 3.1CRITICAL 9.1
- TI-2026-74618 Remote code execution in Email Customizer for WooCommerce (Pro) CVSS 3.1HIGH 8.8
Sources
- CVE-2026-3231 · CVE Program
- CVE-2026-3231 · NVD
- FIRST EPSS
- GHSA-9prh-3fwj-8frx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences