CVE-2026-66707

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Facebook for WooCommerce versions 3.7.5 and earlier, allowing attackers to inject malicious scripts into web pages viewed by users. This can lead to session hijacking, data theft, or site defacement, posing significant risks to both users and site administrators. E-commerce platforms utilizing affected versions should prioritize immediate patching to mitigate potential exploitation.