CVE-2020-36731: Wpdesk Flexible Checkout Fields

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.

Affected products

• Wpdesk Flexible Checkout Fields: up to and including 2.3.1

Published 2023-06-07. Last modified 2026-06-17.