EUVD-2026-50099
GHSA-wp8x-j7cp-hqvg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS payload executes only when a victim visits the injected page, requiring UI:R; all other metrics align with the provided vector.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WowStore - Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in WowStore (all versions ≤ 4.4.24) permits authenticated contributors to plant arbitrary JavaScript into WordPress pages via the unsanitized 'currentPostId' block attribute in the Filter block, which then executes silently in the browser of any subsequent visitor - including administrators. The CVSS 6.4 score reflects Changed scope, meaning low-privilege attackers can impact higher-privilege users. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile) with SSVC confirming no active exploitation, placing this in a prioritize-but-not-emergency tier.
Technical ContextAI
WowStore is a Gutenberg block-based store builder plugin for WordPress/WooCommerce. The vulnerability originates in blocks/Filter.php at lines 97, 116, and 136 (confirmed in the WordPress SVN tag for 4.4.24), where the 'currentPostId' block attribute is rendered into page output without adequate sanitization or escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS) identifies the root cause: user-controllable input flows directly into HTML output without neutralization. WordPress block attributes are stored in post content and rendered server- or client-side; missing output escaping means the attacker's payload survives storage and is faithfully reproduced in the DOM for every subsequent page load.
RemediationAI
Update WowStore to any version above 4.4.24; a fix commit is confirmed in the WordPress plugin SVN changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3625492%40product-blocks&new=3625492%40product-blocks), though the exact patched release version number is not independently confirmed from available data - check the current version in the WordPress.org plugin directory and install the latest available release. As a compensating control on sites unable to update immediately, audit and restrict contributor-level role assignments so that only fully trusted users hold contributor or higher access; this removes the attack prerequisite entirely without requiring the plugin update, at the trade-off of tightening editorial workflow on multi-author sites. Alternatively, a WAF rule blocking script-bearing values in WowStore block attribute parameters can be applied, though this may cause false positives on legitimate rich-text content. Monitor the Wordfence threat intel advisory for confirmed fix version details.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today