What is the CVSS score of CVE-2026-66707?

CVE-2026-66707 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Facebook for WooCommerce are affected by CVE-2026-66707?

The Facebook for WooCommerce plugin (version 3.7.5 and earlier) contains an unauthenticated cross-site scripting vulnerability affecting all site visitors and administrators.

How to fix or mitigate CVE-2026-66707?

Within 24 hours, inventory all WooCommerce instances to identify which are running Facebook for WooCommerce plugin version 3.7.5 or earlier and assess the plugin's active use in your store. Within 7 days, disable or remove the vulnerable plugin pending vendor remediation, deploy Web Application Firewall (WAF) rules to block script injection patterns targeting this plugin's endpoints, and implement Content Security Policy (CSP) headers to restrict inline script execution. Within 30 days, maintain continuous monitoring of the vendor's security advisories for patch availability, evaluate alternative Facebook integration solutions with established security records, and prepare a controlled deployment plan for any patched version once released by the vendor.

Facebook for WooCommerce CVE-2026-66707

EUVD-2026-53910 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-3x4j-9pf3-g254

WordPress XSS Wordpress Plugin Facebook Facebook For Woocommerce

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered XSS with no auth required and scope change into victim browser; A:N assessed because XSS does not credibly impact availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:38 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The affected component is the Facebook for WooCommerce WordPress plugin (CPE: cpe:2.3:a:facebook:facebook_for_woocommerce:*:*:*:*:*:*:*:*), a Meta-developed integration that connects WooCommerce e-commerce stores with Facebook Shops, Pixel tracking, and product catalog sync. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is reflected or stored in HTTP responses without adequate sanitization or encoding, causing the browser to interpret attacker-controlled data as executable script. The unauthenticated nature (PR:N) means the injection point is accessible without any WordPress or WooCommerce account, likely a publicly exposed parameter in the plugin's front-end functionality such as a product feed endpoint, search parameter, or tracking parameter processed by the Facebook Pixel integration.

RemediationAI

Update the Facebook for WooCommerce plugin to the version released after 3.7.5 - consult the WordPress Plugin Directory or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/facebook-for-woocommerce/vulnerability/wordpress-facebook-for-woocommerce-plugin-3-7-5-cross-site-scripting-xss-vulnerability for the confirmed patched release version, which is not independently specified in the available intelligence data. If an immediate update is not possible, a compensating control is to disable the Facebook for WooCommerce plugin entirely until patching is feasible, which eliminates the attack surface at the cost of losing Facebook Pixel tracking, product catalog sync, and Facebook Shop integration. Additionally, deploying a web application firewall rule targeting reflected XSS patterns in the plugin's URL parameters can reduce exploitation likelihood but does not eliminate the root cause and may produce false positives on legitimate traffic. Note that the exact fixed version number is not confirmed by the provided references and should be verified directly with the WordPress Plugin Directory changelog before deploying.