PT-2026-43650 · Clover · Zaytech Smart Online Order

She11F · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-42738

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ZAYTECH Smart Online Order for Clover versions prior to 1.6.1

Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and then served to other users.

Recommendations Update to a version later than 1.6.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42738

Affected Products

Zaytech Smart Online Order

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-42738 · Security Note
• https://twitter.com/VulmonFeeds/status/2059746786982461680 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/clover-online-orders/vulnerability/wordpress-smart-online-order-for-clover-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve · Note