# CVE-2026-66711: WooCommerce Multilingual & Multicurrency cross-site scripting (XSS)

Source: https://junglewise.ai/threats/cve-2026-66711-woocommerce-multilingual-multicurrency-cross-site-scripting-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66711 · Severity: high · CVSS 7.1 · Published 2026-08-06

WooCommerce Multilingual & Multicurrency is a popular WordPress plugin that enables multilingual and multi-currency support for online stores. A reflected cross-site scripting vulnerability in versions up to 5.5.6 allows subscribers to inject malicious scripts that can steal visitor data, hijack accounts, or compromise site functionality. The vulnerability requires user interaction (a victim must click a malicious link or visit a crafted page) but poses a significant risk to e-commerce sites handling customer transactions and sensitive data.

Vendors: [Automattic](https://junglewise.ai/threats/vendors/automattic).

## Quick answers

**Is CVE-2026-66711 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66711 being exploited in the wild.

**How severe is CVE-2026-66711?** High severity, with a CVSS score of 7.1, published 6 August 2026.

**Which products and versions are affected?** Automattic WooCommerce Multilingual & Multicurrency <= 5.5.6.

**Is there a fix for CVE-2026-66711?** A patch was published on 2026-07-31: Patched in version 5.5.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66711 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-66711?** Check whether you run Automattic WooCommerce Multilingual & Multicurrency at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a reflected cross-site scripting (XSS) vulnerability in WooCommerce Multilingual & Multicurrency plugin versions up to 5.5.6. A subscriber-level user can inject unsanitized input that gets reflected in the HTTP response without proper encoding, allowing attackers to execute arbitrary JavaScript in the context of other users' browsers. The vulnerability requires user interaction (the victim must visit a crafted URL or click a malicious link) but does not require administrative privileges to craft the attack payload. Successful exploitation enables account hijacking, session theft, or malware injection. The vulnerability was patched in version 5.5.7.

## Affected products

- Automattic WooCommerce Multilingual & Multicurrency <= 5.5.6

## Timeline

- 2026-07-31: disclosed
- 2026-07-31: patched: Patched in version 5.5.7

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woocommerce-multilingual/vulnerability/wordpress-woocommerce-multilingual-multicurrency-plugin-5-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woocommerce-multilingual/vulnerability/wordpress-woocommerce-multilingual-multicurrency-plugin-5-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [WooCommerce Multilingual & Multicurrency PHP Object Injection](https://junglewise.ai/threats/cve-2026-62130-shop-manager-php-object-injection-in-woocommerce-multilingual)