Facebook for WooCommerce CVE-2026-66707

No authentication to WordPress or WooCommerce is required to deliver the exploit payload (PR:N in CVSS vector). However, exploitation requires a victim user to interact with the attacker-controlled input - specifically, to visit or click a URL or page containing the injected script (UI:R). The plugin must be installed and active on a WordPress/WooCommerce installation running version 3.7.5 or earlier. The scope change (S:C) indicates the injected script executes in the victim's browser session, not on the server, so server-side access is not required by the attacker. Exploitation is limited by the need for victim interaction and by the fact that the highest-value targets (administrators with backend access) require the admin to be authenticated to WordPress at the time of exploitation to achieve account takeover - unauthenticated visitors are lower-value targets whose browser sessions may yield less access.

The CVSS 3.1 score of 7.1 is driven by network accessibility (AV:N), low complexity (AC:L), no required privileges (PR:N), and a scope change (S:C), partially offset by required user interaction (UI:R) and limited individual impact ratings (C:L/I:L/A:L). Real-world risk is moderate-to-elevated for WooCommerce operators: the unauthenticated vector means any internet user can craft a malicious payload, and the primary attack target is likely store administrators or authenticated customers whose session cookies could be exfiltrated. No EPSS data was provided in the intelligence; however, the plugin's broad deployment across WooCommerce stores makes it an attractive mass-exploitation target if a working payload is published. No active exploitation is confirmed (no CISA KEV listing), and no public exploit or proof-of-concept was identified in the provided data. The A:L rating in the provided CVSS vector is atypical for XSS and may reflect page-load disruption rather than a genuine denial-of-service capability - this metric warrants vendor clarification.

An attacker identifies a WooCommerce store running Facebook for WooCommerce 3.7.5 or earlier and crafts a URL embedding malicious JavaScript in a vulnerable parameter exposed by the plugin - for example, a product search or tracking endpoint that reflects input without sanitization. The attacker distributes the crafted URL via phishing email or social media targeting store administrators; when the administrator clicks the link while authenticated to the WordPress dashboard, the injected script executes in their browser, exfiltrating session cookies or wp-nonce tokens that grant the attacker administrative access to the WordPress backend. No exploit code has been publicly identified, but the unauthenticated nature of the flaw lowers the barrier to exploitation significantly.