CVE-2026-103071 HIGH

CVE-2026-103071: WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability

Vendor Villatheme
Product Thank You Page Customizer for WooCommerce
Weakness CWE-94 · Code injection
Published October 10, 2026
Last update October 10, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

Key dates

02Disclosure timeline

October 10, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability CVE-2026-2830 WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' CVE-2025-15463 Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2026-27044 WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability CVE-2026-65553 WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability