What is the CVSS score of EUVD-2026-39379?

EUVD-2026-39379 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Advanced Order Export are affected by EUVD-2026-39379?

A cross-site scripting vulnerability in Advanced Order Export For WooCommerce plugin (versions ≤4.0.9) enables attackers to inject malicious code into customer-visible order pages, creating direct…

How to fix or mitigate EUVD-2026-39379?

Within 24 hours: Disable the Advanced Order Export For WooCommerce plugin across all WordPress instances, or deploy Web Application Firewall (WAF) rules blocking script injection patterns if disablement is operationally infeasible. Within 7 days: Audit all deployed instances for this plugin; enumerate alternative export solutions; monitor AlgolPlus advisories for patch availability. Within 30 days: Migrate to a patched version when released, or replace with a vendor-supported alternative; conduct post-incident review of customer-accessible data for exploitation indicators.

Advanced Order Export EUVD-2026-39379

| CVE-2026-56042 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Patchstack

GHSA-4vjm-ppcq-26j5

WordPress XSS Wordpress Plugin Advanced Order Export For Woocommerce Algolplus

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network XSS with mandatory admin interaction (UI:R) and a scope change to the browser context (S:C); PR:L reflects the 'Customer' actor needed to seed malicious order data, with low C/I/A.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:22 vuln.today

CVE Published

Jun 25, 2026 - 13:12 cve.org

HIGH 7.1

DescriptionCVE.org

Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 1 Critical, 6 High, 2 With POC Jun 26, 2026

AnalysisAI

Stored/reflected Cross-Site Scripting in the Advanced Order Export For WooCommerce WordPress plugin (by AlgolPlus) affects all versions up to and including 4.0.9, letting a remote attacker inject script that executes in the browser of a victim who views attacker-controlled order/export data. The flaw carries a CVSS 7.1 rating driven by a scope change (attacker script runs outside the vulnerable component's security context) and requires victim interaction; there is no public exploit identified at time of analysis and it is not on the CISA KEV list.

Technical ContextAI

The affected component is Advanced Order Export For WooCommerce (CPE cpe:2.3:a:algolplus:advanced_order_export_for_woocommerce), a WordPress/WooCommerce plugin used to export order data to CSV/XLS/XML/JSON. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning customer- or order-supplied input is rendered into an admin or export-preview page without sufficient output encoding or input sanitization. Because WooCommerce order fields (billing names, addresses, notes) often originate from untrusted customers at checkout, those values become a script-injection vector that fires when rendered in the plugin's export/preview interface, typically in an authenticated administrator's session.

RemediationAI

Upgrade Advanced Order Export For WooCommerce to a release later than 4.0.9 once the vendor publishes a fixed version; the available data does not name an exact patched version, so confirm the current fixed release on the plugin page or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-order-export-lite/...) before deploying. No vendor-released patch version is independently confirmed at time of analysis. As compensating controls until patched: restrict access to the plugin's export and order-export admin pages to trusted administrators only; place a WAF rule or Patchstack vPatch to filter script-like payloads in WooCommerce order fields (trade-off: may flag legitimate special characters in addresses/notes); and apply strict input validation on customer checkout fields. If the plugin is not actively used, deactivate and remove it to eliminate exposure (trade-off: loss of export functionality).