What is the CVSS score of CVE-2026-66697?

CVE-2026-66697 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Colissimo WooCommerce are affected by CVE-2026-66697?

The Colissimo Officiel WooCommerce shipping plugin (versions ≤2.10.0) contains an unauthenticated cross-site scripting vulnerability that enables attackers to compromise the confidentiality and…

How to fix or mitigate CVE-2026-66697?

Within 24 hours, identify all WordPress installations running Colissimo Officiel versions 2.10.0 or earlier and disable the plugin immediately; if operationally critical, isolate affected sites from production environments. Within 7 days, conduct forensic review of access logs and session records for signs of unauthorized account activity; reset credentials for all administrator and customer accounts with login history during the exposure window. Within 30 days, establish daily monitoring of vendor security advisories for a patch release; upon availability, test and deploy the patched version to all systems immediately; if no patch is released within 30 days, evaluate alternative shipping solutions and plan permanent plugin removal.

Colissimo WooCommerce CVE-2026-66697

EUVD-2026-57904 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-3pj3-xgvr-86pc

WordPress XSS Wordpress Plugin Colissimo Officiel Colissimo

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

AV:N and PR:N confirmed by unauthenticated network delivery; UI:R required for victim interaction; S:C reflects browser context escape; A:N assessed because XSS does not realistically cause availability disruption to the server or plugin.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:25 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to properly sanitize or encode attacker-controlled input before rendering it in an HTML response, the classic root cause of reflected or stored XSS. The affected product, identified via CPE as cpe:2.3:a:colissimo:colissimo_officiel_:_méthodes_de_livraison_pour_woocommerce, is a WooCommerce plugin that integrates Colissimo (La Poste, France's national postal carrier) shipping methods into WordPress shops. WooCommerce plugins commonly handle customer-facing checkout and shipping forms, which represent natural attack surfaces for unsanitized input. The CVSS scope change (S:C) indicates the vulnerability allows injected script to operate outside the plugin's own security boundary - affecting the victim's browser session across the broader WordPress domain.

RemediationAI

Update the Colissimo Officiel WooCommerce plugin to a version beyond 2.10.0; the exact patched version should be confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/colissimo-shipping-methods-for-woocommerce/vulnerability/wordpress-colissimo-officiel-methodes-de-livraison-pour-woocommerce-plugin-2-10-0-cross-site-scripting-xss-vulnerability) or the WordPress plugin repository changelog. If an immediate update is not possible, consider temporarily deactivating the plugin and using an alternative shipping method to eliminate the attack surface entirely - note this will disable Colissimo shipping options at checkout, impacting customers. As a compensating control, deploying a web application firewall (WAF) rule to block reflected XSS patterns in plugin-specific request parameters can reduce exposure without disabling the plugin, though WAF bypass is possible for determined attackers. Administrators should also audit their site's Content-Security-Policy header to restrict script execution origins, which limits XSS impact even if exploitation occurs.