CVE-2026-57319

HighCVSS 7.1

Published: 26/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in FOX versions 1.4.8 and earlier. It allows a remote attacker to inject malicious script without authentication.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the victim's browser context, leading to confidentiality and integrity breaches.

Recommendation

Immediately upgrade FOX to a version later than 1.4.8 that includes a fix for the XSS vulnerability.

Other vulnerabilities in FOX <= 1.4.8

CVE-2026-108174Medium
The FOX (woocommerce-currency-switcher) plugin up to version 1.5.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS