The EPSS score of 0.00181 for CVE-2026-66700 (unauthenticated XSS in Smart Online Order for Clover) should not comfort you. That score reflects the difficulty of mass-targeting a niche POS plugin — it says nothing about what happens when exploitation succeeds inside a transaction processing system.
This is an unauthenticated cross-site scripting vulnerability in a plugin that handles customer orders through a commercial POS platform. There are no credentials required, no privileged foothold needed. A crafted URL or intercepted order confirmation page is sufficient to execute arbitrary JavaScript in the context of a merchant's ordering session. For a restaurant or retail business running this plugin, that means an attacker can capture payment data, hijack session tokens, or redirect customers to malicious endpoints — all from the outside.
The deeper problem is that EPSS underweights merchant-facing systems by design. The metric models exploit probability across the internet, but it doesn't account for blast radius concentration. One compromised restaurant chain's online ordering portal exposes every customer who placed an order during that window. The plugin ecosystem around Clover and similar POS platforms represents a supply chain that security tooling largely ignores because individual plugins appear low-value. They aren't. Each one is a web-facing entry point to merchant systems that often share session context, merchant credentials, or API tokens with the broader platform. An attacker exploiting this XSS isn't breaking an isolated module — they're already inside the transaction infrastructure.
What makes this worse: the pattern is documented and predictable. WordPress plugins, Magento extensions, and Shopify apps have all produced near-identical unauthenticated XSS vulnerabilities in commerce contexts over the past decade. Each ecosystem repeats the same failure because the economic incentives favor shipping features over securing code, and platform operators don't enforce baseline security standards as a condition of ecosystem participation. XSS is a solved problem at the library level — the failure here isn't technical ignorance, it's workflow friction and absent accountability.
Here's what you should do: audit your merchant-facing commerce infrastructure for third-party POS plugins you didn't install yourself or don't actively monitor. Establish explicit remediation timeline requirements in vendor contracts. Track plugin maintenance status — if the developer abandons the plugin, you inherit the vulnerability with no patch path. For this specific CVE, verify whether the vendor has released a patched version and confirm your deployment is current. The EPSS score tells you how likely mass exploitation is; it tells you nothing about how catastrophic a single successful exploit is when it lands inside a payment processing flow.