EUVD-2026-51702
GHSA-m4wv-xhrh-3qf6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
AV:N and PR:N confirmed by unauthenticated AJAX access; UI:R required by social-engineering dependency; S:C for browser context escape; A:N as reflected XSS carries no credible availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
AnalysisAI
Reflected XSS in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (all versions before 5.0.0) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by exploiting an AJAX endpoint that lacks both nonce validation and capability checks. A publicly available exploit exists per WPScan, lowering the bar for abuse, though EPSS sits at just 0.17% (7th percentile) and CISA has not added this to KEV - suggesting opportunistic rather than widespread active exploitation. The scope-changed CVSS vector (S:C) reflects that a successful attack breaks out of the plugin context into the victim's browser session, enabling session hijacking or credential theft against authenticated WordPress users.
Technical ContextAI
The vulnerability resides in a WordPress plugin (CPE: cpe:2.3:a:unknown:dynamic_pricing_with_discount_rules_for_woocommerce:*:*:*:*:*:*:*:*) that extends WooCommerce with dynamic pricing and discount rule functionality. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): the plugin registers an AJAX action accessible to unauthenticated users (wp_ajax_nopriv_*) and neither validates the WordPress nonce (intended to bind the action to a legitimate session) nor checks that the requesting user holds any required capability. Raw user-supplied input is passed into the AJAX response without sanitization or escaping, causing the browser to interpret attacker-controlled data as executable script. The scope change in the CVSS vector (S:C) is consistent with how browser-executed XSS crosses the plugin's trust boundary into the victim's authenticated session context.
RemediationAI
Upgrade the Dynamic Pricing With Discount Rules for WooCommerce plugin to version 5.0.0 or later, which introduces proper nonce validation and capability checks on the vulnerable AJAX action; this is the only confirmed fix per the WPScan advisory at https://wpscan.com/vulnerability/5e3786de-4b4d-4da2-b129-7b0fef90a386/. If an immediate upgrade is not possible, a compensating control is to temporarily deactivate the plugin entirely - this eliminates the attack surface but also removes all dynamic pricing functionality, which may disrupt store operations. A Web Application Firewall (WAF) rule blocking requests that include script tags or common XSS payloads in parameters sent to the affected AJAX action can reduce risk without disabling the plugin, though WAF bypasses exist and this is not a permanent fix. Restrict admin-facing pages so that administrator sessions are not exposed to untrusted link clicks (e.g., user awareness training, strict Content-Security-Policy headers), since the highest-impact exploitation scenario targets authenticated administrator sessions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Dynamic Pr
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (ve
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today