Premium Packages EUVD-2026-102786

Requires an authenticated account with subscriber-level access or above (PR:L). The attacker injects into the 'note' parameter (order notes) a payload encoded as a hex-escaped sequence (e.g., \x3cimg onerror=...\x3e); this specific encoding is required because sanitize_textarea_field() does not strip it and stripcslashes() only decodes it back into a live HTML tag during admin-side rendering of the order-notes view (src/Admin/Order/views/order-notes.php). The principal limiting factor is that the stored payload only executes when a privileged user (typically an administrator) opens the affected order-notes page - so exploitation depends on victim-side viewing - and the attacker must already possess a valid subscriber+ account, limiting impact on sites that disable open registration. Affects all versions up to and including 7.2.8.

This is a genuine but moderate-priority issue rather than a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) shows network-reachable, low-complexity exploitation, but the PR:L requirement means an attacker must first hold a subscriber-level (or higher) account, which meaningfully narrows the attacker pool to sites allowing self-registration or to insiders. The scope change (S:C) and low-value C/I/A reflect a classic stored XSS payoff: code executes in the victim's authenticated browser context (typically an admin viewing order notes) rather than directly compromising the server. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation; this is a Wordfence-reported research finding, not an in-the-wild campaign. The novel technical detail - hex-escaped payloads surviving sanitize_textarea_field() and being reconstituted by stripcslashes() during admin rendering - makes the bypass credible and reproducible, but realized impact still depends on an administrator rendering the malicious order note. Net: treat as a routine-to-elevated patch priority for affected sites that permit untrusted registration, not an emergency.

An attacker registers or uses a subscriber-level account on a store running the plugin and submits an order note containing a hex-escaped payload such as \x3cimg onerror=...\x3e via the 'note' parameter. The sequence stores without being stripped, then fires as live script when an administrator opens the order-notes view, running in the admin's authenticated session. No public exploit code was identified at time of analysis, though the described hex-escape/stripcslashes() bypass is reproducible from the advisory.