CVE-2026-12402

Name of the Vulnerable Software and Affected Versions OTP Login & Register Woocommerce versions prior to 2.7.4

Description Insufficient input sanitization and output escaping in the fb-config setting allow authenticated attackers with administrator-level access or higher to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into pages, which then execute when a user visits those pages. In multisite environments where administrators lack the unfiltered html capability, this issue can be used to target the network super administrator.

Recommendations Update to a version newer than 2.7.3. Restrict access to the fb-config setting to minimize the risk of script injection.