CVE-2026-66707 Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

Affected products and versions

Product	Affected versions	Fixed in
Facebook for WooCommerce 3.7	earliest → 3.7.5	No fix stated

Other CVEs of Facebook for WooCommerce

The 3 CVEs of Facebook for WooCommerce →

CVE-2026-49059 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing 4.7 Medium CVE-2025-64296 Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting… 5.3 Medium