Unauthenticated stored XSS in SUMO Reward Points for WooCommerce (CVE-2026-7534)

The SUMO Reward Points plugin for WordPress contains an unauthenticated stored cross-site scripting vulnerability in the REST API endpoint `/wp-json/wc-srp/v1/earning`. A flawed capability check in `SRP_REST_Earning_Controller` grants the `rs_earning_read` capability to all users, including unauthenticated visitors, while the `reason` parameter in `create_items()` is not sanitized and output in `column_default()` is not escaped. An unauthenticated attacker can inject arbitrary web scripts into the reward points log that execute when an administrator views the Master Log or User Reward Points admin pages. Affected versions: - <= 32.7.0 We recommend updating to: 32.8.0. CVSS 7.2 · our assessment: this_week Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/366b5051-d042-4425-9aad-b77d93bcd485?source=cve Details: https://vuln.today/cve/CVE-2026-7534