VillaTheme Thank You Page Customizer for WooCommerce: Content Injection
Summary
The WordPress plugin Thank You Page Customizer for WooCommerce up to and including version 1.2.3 contains a code injection flaw (CWE-94) that allows content injection on the order thank-you page. According to Patchstack, an attacker can add unwanted content such as ads, scam text or malware links to affected pages. The CVSS 3.1 score is 7.5 with no privileges and no user interaction required, but the impact is listed as confidentiality only. Version 1.2.4 fixes the issue.
Affected
- Thank You Page Customizer for WooCommerce (slug woo-thank-you-page-customizer) versions up to and including 1.2.3
- Versions from n/a through 1.2.3 according to the CVE description
Fixed in
- Version 1.2.4 or later (changelog dated 2026.10.08; escapes order placeholder values before substitution into the thank-you page content)
Workaround
- Unknown beyond updating. No vendor-documented workaround found.
- If an update is not possible, deactivate the plugin until it is patched.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV.
- Public proof of concept: none found (unverified).
- Exploitation in the wild: none reported in sources reviewed (unverified).
- Patchstack describes the vulnerability as expected to be exploited and used in mass-exploit campaigns.
Our recommendation
- Check all WooCommerce sites for the installed version of this plugin, including older client sites.
- Update to version 1.2.4 or later without delay.
- If an update is not possible, deactivate the plugin.
- Monitor the website for unexpected content on the thank-you page and review the Patchstack and VillaTheme pages for further updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- WordPress.org plugin listing (changelog) wordpress.org
- OpenCVE CVE-2026-103071 app.opencve.io
- HOL Guard CVE-2026-103071 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 20:13.
Original description (NVD)
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.