WC Fields Factory CVE-2026-39727

Requires the WC Fields Factory plugin (version 4.1.12 or earlier) installed and active on a WordPress/WooCommerce site, AND an authenticated subscriber-level account under the attacker's control (PR:L). Exploitation is further gated on user interaction (UI:R): a victim - typically an administrator or staff user - must view the attacker-supplied field content for the stored/reflected script to execute. These two limiting factors (low-privilege authentication plus required victim interaction) substantially narrow realistic exploitation versus an unauthenticated, no-interaction flaw, despite the network attack vector.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in the WooCommerce add-on WC Fields Factory. The signals point to a real but conditional risk rather than a drop-everything priority. Positive risk factors: network attack vector (AV:N), low complexity (AC:L), and a changed scope (S:C) meaning the injected script executes in the context of other users/the broader WordPress session. Mitigating factors are significant: PR:L requires the attacker to already hold a valid low-privilege account (subscriber), and UI:R means a victim (typically an admin or another user) must view the malicious content for the payload to fire. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the intelligence set - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Subscriber' qualifier in the title is consistent with the PR:L metric. Net assessment: a legitimate issue worth patching on a normal cadence, but the subscriber-account prerequisite plus required user interaction make opportunistic mass exploitation unlikely; the realistic threat is a malicious or compromised low-privilege user escalating against site operators.

An attacker who has registered (or hijacked) a low-privilege subscriber account on a WooCommerce store running WC Fields Factory submits a crafted field value containing a JavaScript payload. When an administrator or other privileged user later views that data in the WordPress dashboard, the script executes in their browser context (scope change), potentially stealing session cookies or performing actions on their behalf. No public exploit code was identified in the provided data, so exploitation would require an attacker to develop the payload themselves.