Additional Order Filters CVE-2026-39800

Exploitation targets the plugin's order-filter functionality and requires a victim with access to the affected page (per UI:R in the CVSS vector) to load attacker-controlled input - the attacker cannot complete the attack purely autonomously. The flaw itself needs no attacker authentication (PR:N), but realistic impact depends on a logged-in operator/admin (shop manager viewing orders) triggering the injected script in their browser session. Limiting factors: the required user interaction, the need for the store to run the specific 'Additional Order Filters for WooCommerce' plugin at version 1.24 or earlier, and impact confined to the browser/session context rather than direct server-side compromise.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 7.1 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, low-complexity, unauthenticated flaw whose severity is inflated by the scope change (S:C) that is conventional for XSS - the elevated score comes from browser-context impact rather than direct server compromise. Critically, exploitation requires user interaction (UI:R), meaning an attacker must lure or wait for a victim (typically an authenticated admin/shop manager viewing order data) to trigger the payload, which materially limits mass automated exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent (network vector matches a web-based plugin; no conflicts between CVSS and description). The dominant risk-reducing factor is the product's narrow footprint: this is a niche WooCommerce add-on, so real-world attack surface is small despite the 'High' label.

An attacker crafts a malicious URL or submits crafted order-filter input containing a script payload to a WooCommerce store running the vulnerable plugin. When a store operator or admin later views the affected order-filter page in their browser, the unsanitized payload executes in their session, potentially stealing session cookies or performing actions as that user. No public proof-of-concept exploit was identified in the provided data.