CVE-2026-66711

WooCommerce Multilingual & Multicurrency versions up to 5.5.6 are vulnerable to a Subscriber Cross Site Scripting (XSS) attack, allowing attackers to inject malicious scripts that can execute in the context of a user's session. This vulnerability poses a significant risk as it could lead to unauthorized actions or data exposure for users with subscriber-level access. E-commerce site administrators using affected versions should prioritize immediate updates to mitigate potential exploitation.