What is the CVSS score of CVE-2026-6962?

CVE-2026-6962 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Cost of Goods for WooCommerce CVE-2026-6962

EUVD-2026-29898 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-13 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 05:30 vuln.today

CVE Published

May 13, 2026 - 04:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_cog_product_cost' and 'alg_wc_cog_product_profit' shortcodes in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin (all versions up to 4.1.0) allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via unsanitized shortcode attributes 'alg_wc_cog_product_cost' and 'alg_wc_cog_product_profit', which executes in the browsers of all users viewing the affected pages. The vulnerability requires prior account access but no user interaction for execution, making it a persistent attack vector for privilege escalation or malicious content injection on WordPress sites.

Technical ContextAI

The vulnerability resides in WordPress shortcode processing within the Cost of Goods plugin. Shortcodes are a WordPress feature allowing dynamic content generation via square-bracket syntax; the plugin implements custom shortcodes to display product cost and profit data. The root cause is insufficient input sanitization on shortcode attributes before rendering and insufficient output escaping when those attributes are displayed. This falls under CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'). The affected code paths are in class-alg-wc-cog-products.php (lines 119, 133, and 158 per references), where user-supplied shortcode parameters are directly interpolated into HTML output without proper WordPress escaping functions like esc_attr(), esc_html(), or wp_kses_post(). The CPE string 'cpe:2.3:a:wpcodefactory:cost_of_goods_product_cost_profit_calculator_for_woocommerce:*:*:*:*:*:*:*:*:*' confirms all versions of the plugin are affected.

RemediationAI

Upgrade the Cost of Goods plugin to a version newer than 4.1.0 that includes input sanitization and output escaping fixes (version number for patched release not specified in provided data; verify with wpcodefactory or Wordfence advisory). Immediate compensating controls for unpatched sites: restrict contributor-level and above role assignments to trusted administrators only, audit existing contributor and author users to identify inactive or suspicious accounts, and review recent posts/pages containing '[alg_wc_cog_product_cost]' or '[alg_wc_cog_product_profit]' shortcodes for injected scripts. If the plugin cannot be removed, disable use of the vulnerable shortcodes by removing them from all pages and posts, or restrict page editing capabilities to administrators only via role management plugins. Note that these workarounds limit site functionality or usability; plugin update is the recommended path.