CVE-2026-66700

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Smart Online Order for Clover plugin version 1.6.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser without requiring authentication.

Risk Assessment

The risk includes user session theft, account takeover, displaying fake content, or redirecting to malicious sites. This could lead to compromise of user data confidentiality.

Recommendation

It is recommended to update the Smart Online Order for Clover plugin to a version newer than 1.6.1. Also, apply input filtering and sanitization mechanisms.

Other vulnerabilities in Smart Online Order for Clover

CVE-2025-15635Medium
Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover plugin. Allows an attacker to perform unauthorized actions on behalf of a logged-in user. Affects versions up to and including 1.6.0.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS