Sumo Reward Points For Woocommerce
Monthly
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.