EUVD-2026-26746Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Call for Price for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in Call for Price for WooCommerce plugin versions up to 4.2.0 allows authenticated administrators to inject arbitrary JavaScript via plugin settings that executes for all users visiting affected pages. The vulnerability requires administrator-level access and is limited to WordPress multisite installations or single-site installations with the unfiltered_html capability disabled, significantly reducing real-world exposure compared to the CVSS score of 4.4 suggests.
Technical ContextAI
The vulnerability exists in the plugin's admin settings handling, specifically in the class-wc-call-for-price-settings-product-types.php and class-wc-call-for-price.php files where user-supplied input from administrator configuration fields is not properly sanitized before storage or escaped before output. This is a classic Stored XSS flaw (CWE-79) where the plugin fails to apply WordPress security functions like sanitize_text_field() on input or wp_kses_post() on output. The vulnerability is exacerbated on multisite installations where additional restrictions apply to HTML filtering, and on single-site installations that have disabled the unfiltered_html capability-a security hardening measure that prevents administrators from directly entering HTML. The CPE indicates all versions of the tychesoftwares Call for Price for WooCommerce plugin are affected through version 4.2.0.
RemediationAI
The primary remediation is to upgrade the Call for Price for WooCommerce plugin to version 4.2.1 or later once released by Tyche Softwares; administrators should check the WordPress Plugin Repository or the vendor's advisory for the patched version. In the interim, organizations can apply compensating controls by restricting administrator role assignments to trusted users only and conducting regular audits of admin accounts to detect unauthorized access; this does not eliminate the vulnerability but significantly reduces the attack surface. For WordPress multisite installations, administrators should verify that unfiltered_html capability remains disabled for non-super-admin users, which is the default configuration and provides defense-in-depth against this class of XSS injection. Site administrators should also implement a Web Application Firewall (WAF) rule to detect and block script tag injection in the plugin's configuration endpoints (typically /wp-admin/admin.php?page=call-for-price* or similar), though this is a monitoring control rather than a true fix. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7bffb16d-38dc-49b8-96bd-c13923069d9c?source=cve provides additional technical details and should be consulted for confirmation of patch availability and release timing.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today