EUVD-2026-90214
GHSA-26pf-c54w-pvvf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload in CURCY input
-
DeliveryDeliver crafted link to WooCommerce user
-
ExploitVictim browser renders unsanitized output
-
ExecutionScript executes in victim session
-
ImpactHijack session or act as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the CURCY (Woo Multi Currency) WooCommerce plugin at version 2.2.16 or earlier via an unsanitized input/output path (CWE-79). Although unauthenticated (PR:N), successful exploitation REQUIRES user interaction (UI:R) - a victim must click a crafted link or render attacker-controlled content - which is the primary limiting factor. It also requires the WordPress site to have the vulnerable CURCY plugin installed and active; sites not running this plugin or already on a patched version above 2.2.16 are unaffected. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, unauthenticated, low-complexity reflected/stored cross-site scripting flaw that requires victim user interaction and crosses a security scope boundary. This is a classic mid-severity WordPress plugin XSS rather than a drop-everything emergency: it is not on the CISA KEV list, no EPSS score was supplied, and no public proof-of-concept is referenced - only the Patchstack advisory. The S:C (scope change) and non-zero A:L in the vendor vector are somewhat aggressive for a browser-side XSS; Patchstack frequently assigns S:C to reflect DOM/session impact on a different security authority, but the availability impact (A:L) is not well justified by an XSS payload and is the weakest-supported metric. Net assessment: a genuine but routine web-app vulnerability whose real-world risk is gated by the need to lure an authenticated administrator/user into triggering the payload (UI:R). Treat as a standard patch-cycle item for sites running CURCY (Woo Multi Currency) <= 2.2.16, elevated only if the site has high-value admin accounts or public-facing input paths. |
| Exploit ScenarioDerived | An attacker crafts a URL or input containing a malicious script payload targeting a vulnerable parameter in the CURCY (Woo Multi Currency) plugin and delivers it to a WooCommerce site user or administrator (e.g., via a link). When the victim's browser renders the unsanitized output, the script executes in their session context, enabling session/cookie theft or actions on their behalf. No exploit code is publicly identified at time of analysis, and exploitation requires the victim to interact with the malicious content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated cross-site scripting in the CURCY (Woo Multi Currency) plugin for WordPress, affecting all versions up to and including 2.2.16, allows remote attackers to inject and execute arbitrary script in the context of a victim's browsing session. Exploitation is network-reachable and low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 7.1), but it does require victim user interaction - the target must click a crafted link or otherwise render attacker-controlled content - and it only affects WordPress sites where the vulnerable plugin is installed and active. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical exposure is therefore driven by user interaction and by how many sites still run CURCY at or below 2.2.16.
RemediationAI
No vendor-released patch with an exact fixed version is identified in the provided data; the only confirmed boundary is that CURCY versions up to and including 2.2.16 are vulnerable, so the primary action is to upgrade the plugin to whatever release the vendor publishes above 2.2.16 and to verify the installed version after updating - check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-2-16-cross-site-scripting-xss-vulnerability?_s_id=cve and the vendor's Woo Multi Currency release notes for the corrected build, since absence of a stated fix version here is not confirmation that no fix exists. If an immediate upgrade is not possible, the most effective compensating control is to deactivate and remove the CURCY plugin entirely, accepting the trade-off that multi-currency pricing, currency switching and exchange-rate features stop working; alternatively, restrict access so that only trusted administrators can reach plugin-rendered pages, though this limits storefront functionality for customers. A web application firewall or reverse-proxy rule that blocks script-bearing payloads in requests to CURCY endpoints and sets input encoding/escaping, plus a Content-Security-Policy that disallows inline script, can reduce exploitability but must be tuned to avoid blocking legitimate currency-switch parameters and may break storefront scripts. Because exploitation requires victim interaction (UI:R), user awareness around unsolicited links into the store and prompt patching of browsing clients provide only marginal additional risk reduction and should not replace remediation of the plugin itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-79 improper neutralization of input during web page generation, reported by Patchstack against the CURCY plugin (CPE cpe:2.3:a:villatheme:curcy:*:*:*:*:*:*:*:*, EUVD-2026-90214), which is a WordPress/WooCommerce extension that adds multi-currency pricing, currency switching and exchange-rate handling to online stores. An unsanitized input/output path in the plugin allows attacker-supplied data to be echoed into a page without adequate encoding or escaping, producing reflected or stored script execution. Because the CVSS vector marks scope change (S:C), the injected script executes with the privileges of the vulnerable WordPress application rather than staying confined to the injection component, which is why script abuse can be leveraged against authenticated site users (including administrators viewing plugin-rendered content) even though the attacker needs no credentials of their own. The vector's UI:R reflects that a victim must be induced to visit a crafted URL or render the tainted content, and the C:L/I:L ratings in the authoritative assessment indicate limited, not full, confidentiality and integrity impact within that user's session; availability impact is not confirmed (A:N). Authentication requirements are unauthenticated per PR:N in the provided CVSS vector.
Know when Curcy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable unauthenticated XSS needing victim interaction (UI:R) with scope change to the browser context and low C/I impact; availability impact does not apply to XSS, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16 versions.
Executive ViewAI
The CURCY (Woo Multi Currency) plugin for WordPress, in all versions up to and including 2.2.16, contains an unauthenticated cross-site scripting flaw that allows an attacker to execute arbitrary script in the browser session of any user who clicks a crafted link - including store administrators and paying customers on WooCommerce storefronts. No vendor patch is available, so every internet-facing WordPress site with this plugin active remains exposed, and compromise of an administrator's session could cascade into full site takeover, data theft, or malicious modification of checkout and pricing flows. Leadership should care because the affected asset class is customer-facing and revenue-generating, and remediation currently depends on organizational action rather than a vendor fix.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall CURCY (Woo Multi Currency) 2.2.16 and earlier where the functionality is not essential; where it must remain active, apply WAF or virtual-patching rules targeting the plugin's endpoints and script-injection payloads, enforce a strict Content-Security-Policy, restrict wp-admin and WooCommerce account access to trusted networks/VPN with MFA, strip or sanitize untrusted URL parameters at the edge, and monitor logs for suspicious admin sessions and injected script activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY -
Incorrect currency-calculation logic in the VillaTheme CURCY (woo-multi-currency) WordPress plugin, present in every rel
Exploit-DB