ShopEngine WordPress Plugin CVE-2026-85575

The attacker must hold a WordPress account with at least Author-level role on the target site; Editor, Shop Manager, and Administrator roles are also sufficient. The ShopEngine Elementor WooCommerce Builder Addon plugin must be installed and active at version 4.9.5 or earlier. The attacker must be able to create or edit a post, page, or product that uses a ShopEngine product title widget and set the shopengine_product_title_header_size parameter. Exploitation is limited by the authentication requirement: sites that do not grant Author or higher access to untrusted external parties are not exposed through this path. There is no evidence of a network-reachable unauthenticated vector. The vulnerability is not known to be exploited in the wild and no public proof-of-concept exists.

The NVD/Wordfence CVSS score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects the stored nature of the XSS and the scope change to the victim browser. The PR:L metric accurately captures the Author-level authentication requirement, which meaningfully constrains exploitation - this is not an unauthenticated attack path. In typical WordPress WooCommerce deployments, Author-level accounts may be granted to content contributors and guest bloggers, but shop owners on smaller sites often restrict this tier, lowering practical exposure. No EPSS score is available in the provided data, no public proof-of-concept has been identified, and CISA KEV does not list this CVE, all indicating no evidence of active exploitation. The primary real-world risk is on multi-author or marketplace WordPress installations where untrusted users hold Author or higher roles and can place ShopEngine widgets. The CVSS score of 6.4 (Medium) accurately characterizes this as a meaningful but not critical risk; it is not a high-priority emergency for single-author or fully trusted-staff WordPress sites.

An attacker who holds or compromises a WordPress Author-level account on a target WooCommerce store opens the ShopEngine Elementor builder, places a product title widget, and sets the shopengine_product_title_header_size parameter to a value containing a JavaScript payload (e.g., injecting an event handler or script tag). Once saved, the payload is stored in the WordPress database and executes silently in every subsequent visitor's browser, allowing the attacker to steal session cookies, capture WooCommerce checkout form data, or redirect customers to phishing pages. No public exploit code is known, but the technique is elementary for any developer-level attacker familiar with WordPress Elementor widget parameters.