What is the CVSS score of CVE-2026-3231?

CVE-2026-3231 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-3231?

A stored cross-site scripting (XSS) vulnerability in WooCommerce plugin versions up to 2.1.7 allows attackers to inject malicious code through custom form fields, potentially compromising customer…

How to fix or mitigate CVE-2026-3231?

Within 24 hours: Inventory all WordPress installations running WooCommerce and identify version numbers; disable custom radio and checkbox field functionality if possible. Within 7 days: Implement WAF rules to sanitize form inputs and monitor for XSS payloads; contact WooCommerce for patch availability timeline. Within 30 days: Upgrade to patched version immediately upon release; conduct security audit of form submissions and customer data for signs of compromise.

PHP CVE-2026-3231

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-11 security@wordfence.com

WordPress PHP XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 10:16 nvd

HIGH 7.2

DescriptionCVE.org

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the prepare_single_field_data() method in class-thwcfd-block-order-data.php first escaping values with esc_html() then immediately reversing the escaping with html_entity_decode() for radio and checkboxgroup field types, combined with a permissive wp_kses() allowlist in get_allowed_html() that explicitly permits the <select> element with the onchange event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page.

AnalysisAI

for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted versions up to 2.1.7. is affected by cross-site scripting (xss) (CVSS 7.2).

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) exists in the Store API checkout component. The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the prepare_single_field_data() method in class-thwcfd-block-order-data.php first escaping values with esc_html() then immediately reversing the escaping with html_entity_decode() for radio and chec

Affected ProductsAI

Product: for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted. Versions: up to 2.1.7.. Component: Store API checkout.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.