CVE-2020-36731 Scanner
CVE-2020-36731 Scanner - Unauthenticated Arbitrary Plugin Settings Update vulnerability in Flexible Checkout Fields for WooCommerce
Used 3.4k times · 3.3k assets checked · domain, subdomain, ipv4
CVE
CVE-2020-36731
6.1
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
flexible checkout fields for woocommerce – woocommerce checkout manager
Updated Sep 25, 2026View on NVD →
S4E scanner
CVE history: flexible checkout fields for woocommerce – woocommerce checkout manager
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →