EUVD-2026-91190
GHSA-gcf4-jm96-42wg
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Shop-manager account required (PR:H) and victim must view the page (UI:R); stored XSS crosses a privilege boundary into the victim's context (S:C) with partial C/I and no availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.
AnalysisAI
Stored cross-site scripting in the Tabs Responsive WordPress plugin (through version 2.5) allows an authenticated shop manager holding product-tab editing capability to persist JavaScript inside a WooCommerce product tab, which then executes in the browser of any user who views that product page, including an administrator. Exploitation depends on a pre-existing WooCommerce installation, the attacker already possessing a shop manager or higher account, and victim interaction (the malicious tab must be rendered by another user), making this a privileged-insider or compromised-account scenario rather than anonymous remote access (CVSS vector PR:H/UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an active WooCommerce installation alongside the Tabs Responsive plugin (through version 2.5), and the attacker must already hold a shop manager (or higher) account with capability to edit product tab content - this is a privileged-insider / compromised-account precondition, not anonymous access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored XSS (CWE-79) in the Tabs Responsive WordPress plugin (≤2.5) reachable only by an already-authenticated shop manager, as reflected by the input vector's PR:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data for CVE-2026-13718 - the advisory (https://wpscan.com/vulnerability/ff0da7b7-f415-466e-9f6e-4c559d2699a9/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-13718) document the issue against versions through 2.5 but do not name a fixed release, so the first action is to monitor the WPScan advisory page and the plugin's changelog and upgrade to the first version above 2.5 as soon as it ships. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today