What is the CVSS score of CVE-2026-66700?

CVE-2026-66700 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Smart Online Order are affected by CVE-2026-66700?

Zaytech's Smart Online Order for Clover WordPress plugin (all versions through 1.6.1) contains an unauthenticated cross-site scripting vulnerability (CVSS 7.1) that allows remote attackers to inject…

How to fix or mitigate CVE-2026-66700?

Within 24 hours, immediately disable the Zaytech Smart Online Order for Clover plugin on all affected installations, or if operationally critical, deploy Web Application Firewall rules blocking malicious input patterns to this component. Within 7 days, audit WordPress access logs and session activity for signs of exploitation, assess user actions during the vulnerability window, and evaluate functionally equivalent replacement plugins. Within 30 days, continuously monitor Zaytech security advisories for a patch release; once Zaytech publishes a fix, apply it to all instances and conduct security testing before re-enabling in production.

Smart Online Order CVE-2026-66700

EUVD-2026-57906 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-gc6w-4jcx-6mg9

WordPress XSS Smart Online Order For Clover Wordpress Plugin Zaytech

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated reflected XSS over the network with scope change justifies AV:N/PR:N/S:C; A:N assigned because reflected XSS does not impair service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:25 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

AnalysisAI

Unauthenticated reflected cross-site scripting (XSS) in Zaytech's Smart Online Order for Clover WordPress plugin, affecting all versions through 1.6.1, allows remote unauthenticated attackers to inject and execute arbitrary JavaScript within a victim's browser session. The scope change (S:C) in the CVSS vector confirms the payload escapes the plugin's component boundary and executes in the authenticated WordPress session context of the targeted user, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Smart Online Order for Clover is a WordPress plugin developed by Zaytech (CPE: cpe:2.3:a:zaytech:smart_online_order_for_clover:*:*:*:*:*:*:*:*) that integrates restaurant and retail online ordering workflows with the Clover point-of-sale platform. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected into an HTTP response without adequate output encoding or sanitization. Because the CVSS vector specifies PR:N, the vulnerable endpoint processes unsanitized input without requiring any authentication, making the injection surface reachable by any unauthenticated network requestor. The S:C (Scope Changed) metric indicates the injected script crosses the plugin's component trust boundary and executes within the victim's browser security context - typically that of a logged-in WordPress administrator - enabling impacts beyond the plugin itself.

RemediationAI

Site administrators should update the Smart Online Order for Clover plugin to a version beyond 1.6.1 without delay. Patch availability is indicated by the Patchstack coordinated disclosure advisory at https://patchstack.com/database/wordpress/plugin/clover-online-orders/vulnerability/wordpress-smart-online-order-for-clover-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve; however, the exact patched version number is not confirmed in the provided data and must be verified via the WordPress.org plugin repository or Zaytech's release notes before deployment. As a compensating control where immediate patching is not feasible, enabling a WAF rule set that filters reflected XSS payloads - such as those provided by Wordfence or Sucuri for WordPress - can reduce exposure, though overly aggressive XSS rules may generate false positives on legitimate plugin form input and should be tested before full enforcement. Where the Clover ordering interface is not required to be publicly accessible, restricting the vulnerable endpoint by IP allowlist at the server or CDN layer eliminates unauthenticated access entirely without affecting authenticated admin workflows. Privileged WordPress accounts should use unique credentials and active sessions should be invalidated after any suspected exposure.