CVE-2026-3231
Published: 11 March 2026
Summary
CVE-2026-3231 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-3231 is a stored cross-site scripting (XSS) vulnerability in the Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress, affecting all versions up to and including 2.1.7. The issue arises in the `prepare_single_field_data()` method within `class-thwcfd-block-order-data.php`, where field values for custom radio and checkboxgroup types are first escaped using `esc_html()` and then immediately unescaped with `html_entity_decode()`. This is compounded by a permissive `wp_kses()` allowlist in `get_allowed_html()` that permits the `<select>` element with the `onchange` event handler attribute.
Unauthenticated attackers can exploit this vulnerability by submitting malicious custom radio or checkboxgroup field values through the WooCommerce Block Checkout Store API endpoint. The injected scripts are stored and execute in the administrator's browser when viewing the order details page in the WordPress dashboard. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is associated with CWE-79 (Improper Neutralization of Input During Web Page Generation).
References provided include source code locations in the plugin's Trac repository, such as lines in `class-thwcfd-block-order-data.php`, `class-thwcfd-block.php`, and `class-thwcfd-utils.php`, along with a changeset comparing revisions 3454287 and 3478914 in the trunk, indicating a patch has been applied. Additional details are available in the CleanTalk research advisory at https://research.cleantalk.org/cve-2026-3231/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11131
Vulnerability details
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7.…
more
This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public WooCommerce Block Checkout Store API (T1190) directly enables unauthenticated script injection; permissive sanitization allows arbitrary JavaScript execution (T1059.007) in admin dashboard context on order view.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation, filtering, and sanitization of untrusted input from the Store API before it is stored and later rendered in order details, blocking the radio/checkboxgroup XSS payload.
Requires output filtering/encoding of stored field data when the administrator views orders, countering the html_entity_decode bypass and permissive wp_kses allowlist.
Provides malicious-code inspection and sandboxing that can detect or block script injection attempts at the checkout endpoint or dashboard rendering layer.