The Checkout Field Editor plugin (WooCommerce <= 2.1.7) contains a flaw in the prepare_single_field_data() function. Custom radio and checkboxgroup field values are escaped with esc_html() but immediately reversed with html_entity_decode(), and the get_allowed_html() function permits the &lt;select&gt; element with an onchange handler. This combination allows unauthenticated attackers to store malicious script payloads via the WooCommerce Block Checkout Store API. When an administrator later views an order details page, the injected script executes in the admin context, providing a Stored Cross‑Site Scripting (CWE‑79) that could lead to session hijacking, defacement, or other malicious actions performed with administrative privileges.

Any WordPress site running the themehigh “Checkout Field Editor (Checkout Manager) for WooCommerce” plugin in a version up to and including 2.1.7 is affected. No other vendors or products are listed, so the vulnerability is limited to this specific plugin and its older releases.

The CVSS base score of 7.2 indicates a high-impact vulnerability. The EPSS score is reported as less than 1 %, signifying a low current exploitation probability and indicating that widespread exploitation has not been observed. It is not present in the CISA KEV catalog. Attackers can exploit the flaw without authentication by submitting malicious values through the front‑end checkout process; the payload is then stored and executed when an administrator accesses the order. The exploitation effort is low, but the potential impact is significant given the administrator privilege context.