Eu Vat Assistant For Woocommerce
Monthly
Stored cross-site scripting in the EU VAT Assistant for WooCommerce plugin (all versions up to and including 2.1.30.260413) lets an unauthenticated visitor inject arbitrary script through the customer-supplied 'vat_number' field at checkout, which is persisted and later rendered without escaping inside WooCommerce → Orders → Edit Order. The payload fires in the reviewing administrator's browser session, so a single poisoned order can be leveraged to create a rogue administrator account and take over the entire WordPress site. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity, lack of authentication requirements (CVSS PR:N), scope change, and the fact that the trigger is a routine admin workflow make this a genuine, actionable priority for any store running the plugin on default configuration.
Stored cross-site scripting in the EU VAT Assistant for WooCommerce plugin (all versions up to and including 2.1.30.260413) lets an unauthenticated visitor inject arbitrary script through the customer-supplied 'vat_number' field at checkout, which is persisted and later rendered without escaping inside WooCommerce → Orders → Edit Order. The payload fires in the reviewing administrator's browser session, so a single poisoned order can be leveraged to create a rogue administrator account and take over the entire WordPress site. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low attack complexity, lack of authentication requirements (CVSS PR:N), scope change, and the fact that the trigger is a routine admin workflow make this a genuine, actionable priority for any store running the plugin on default configuration.