FlexStock CVE-2026-107711

Requires an authenticated Subscriber-level (or higher) account on a WordPress site with FlexStock ≤3.17.2 installed and active - practically low-barrier where customer self-registration is enabled, as is common on WooCommerce stores. No special plugin configuration is needed: the admin_enqueue_scripts callback unconditionally exposes the REST bearer token via wp_localize_script() in the Dashboard page source, and the REST endpoint's permission_callback checks only that bearer token rather than a current_user_can() capability check, so any logged-in Subscriber can reach the vulnerable products[].post_content write path. Limiting factors: an account is required (PR:L, not unauthenticated), and impact is realized only when another user subsequently views the injected page (stored payload, delayed execution).

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reported by Wordfence. The signals are internally consistent: network-reachable (AV:N), low complexity (AC:L), scope change (S:C, reflecting script execution in another user's browser context), and low confidentiality/integrity impact with no availability impact. The key risk driver is the low privilege barrier (PR:L): the advisory states any Subscriber-level user can exploit it because the admin_enqueue_scripts callback leaks the REST bearer token in the Dashboard page source and the REST permission_callback validates only that token instead of calling current_user_can(). On WooCommerce stores with open customer/account registration, Subscriber access is trivially obtained, which effectively lowers the practical barrier. No EPSS score is present in the input and the CVE is not on CISA KEV, so there is no evidence of widespread or active exploitation; the vuln.today Decision label is 'this_month' (not act_now/emergency). No verified working exploit code is referenced - the links are the Wordfence advisory and plugin source lines, not a PoC. Net: a genuine but not emergency priority - patch on a routine monthly cycle, prioritized upward where self-registration is enabled. EPSS data is missing, so exploitation probability could not be weighed quantitatively.

An attacker registers (or already holds) a Subscriber-level account on a WordPress store running FlexStock ≤3.17.2, then reads the REST bearer token exposed in the Dashboard page source and calls the plugin's REST endpoint to write a malicious script into a product's 'post_content'. The payload is stored and later executes in the browser of any user - including an administrator - who views the affected product page, enabling session/account compromise. No public exploit identified at time of analysis; only the vendor advisory and source-code references are provided.