What is the CVSS score of CVE-2026-59556?

CVE-2026-59556 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Dynamic Pricing WooCommerce are affected by CVE-2026-59556?

The Acowebs Dynamic Pricing plugin for WooCommerce (versions up to 4.5.11) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts…

How to fix or mitigate CVE-2026-59556?

Within 24 hours, identify all WooCommerce installations using the Acowebs Dynamic Pricing plugin and document which versions are deployed up to 4.5.11. Within 7 days, implement compensating controls: disable the plugin if feasible, or deploy Web Application Firewall rules to block XSS payloads and enforce Content Security Policy headers to restrict script execution; enable multi-factor authentication on all administrator accounts; and establish real-time monitoring of administrator session activity for anomalies. Within 30 days, evaluate alternative pricing plugins without known security vulnerabilities and execute migration plan.

Dynamic Pricing WooCommerce CVE-2026-59556

EUVD-2026-49223 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-27 Patchstack

GHSA-fg9v-69wx-mgvq

WordPress XSS Dynamic Pricing With Discount Rules For Woocommerce Wordpress Plugin Acowebs

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-delivered reflected XSS requires a victim click (UI:R) and executes cross-scope in the site origin (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 14:53 vuln.today

CVE Published

Jul 27, 2026 - 13:59 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.

AnalysisAI

Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.

Technical ContextAI

The affected component is a WooCommerce add-on plugin (CPE cpe:2.3:a:acowebs:dynamic_pricing_with_discount_rules_for_woocommerce) that layers conditional/bulk pricing and discount rules onto WooCommerce storefronts running on WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected into an HTML response without adequate output encoding or input sanitization. Because the CVSS vector marks scope as changed (S:C), the injected script executes outside the immediate vulnerable component's privilege boundary - typical of reflected XSS where an unauthenticated request causes script to run within the trusted site origin, affecting other users such as logged-in administrators.

RemediationAI

Update the "Dynamic Pricing With Discount Rules for WooCommerce" plugin to a release newer than 4.5.11 once the vendor publishes a fixed version; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/aco-woo-dynamic-pricing/vulnerability/wordpress-dynamic-pricing-with-discount-rules-for-woocommerce-plugin-4-5-11-cross-site-scripting-xss-vulnerability) is the authoritative source to confirm the exact patched version, which is not stated in the provided data. Because the affected range is capped at 4.5.11 with no fix version supplied here, treat the released patched version as not independently confirmed and verify on the vendor/Patchstack page before deploying. As compensating controls until patched, deploy a WAF or virtual patch (Patchstack offers one) to filter XSS payloads against the plugin's request parameters, restrict or monitor access to the vulnerable front-end endpoints, and set a strict Content-Security-Policy that disallows inline script to blunt reflected-XSS execution - noting a strict CSP can break themes/plugins relying on inline scripts and requires testing. If the plugin is not essential, deactivating and removing it eliminates the exposure at the cost of losing dynamic-pricing functionality.