¿Es seguro Woo Checkout Field Editor Pro?

Qué hace este plugin

• Slug: woo-checkout-field-editor-pro
• 400000+ instalaciones activas

checkout field editorcheckout managercustom fieldsWooCommerce checkoutWoocommerce checkout field

Estado de mantenimiento

• Última versión conocida: 2.1.9
• Requiere PHP: 5.6+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

3 CVEs conocidos registrados para Woo Checkout Field Editor Pro.

CVE-2024-8499

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘render_review_request_notice’ function in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-3490

The Checkout Field Editor plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.7.2 via deserialization of untrusted input from the 'save_plugin_settings' function and the 'i_settings_data' parameter. This allows administrator-level attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-3231

The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Woo Checkout Field Editor Pro actualizado — 2.1.9 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Checkout Field Manager (Checkout Manager) for WooCommerce — 90000+ instalaciones activas — 90/100 (781) — PHP máx. 8.4
• Digital Goods (Checkout Field Editor) for WooCommerce Checkout — 3000+ instalaciones activas — 90/100 (41) — PHP máx. 8.4
• Custom WooCommerce Checkout Fields Editor — 2000+ instalaciones activas — 68/100 (18) — PHP máx. 8.4
• Checkout Field Editor (Checkout Page Manager) for WooCommerce — 2000+ instalaciones activas — 94/100 (35) — PHP máx. 8.4