CVE-2026-17162

MEDIUM

Wpxpo WowStore <= 4.4.24 - Contributor+ Stored Cross-Site Scripting via currentPostId

Title source: manual
STIX 2.1

Description

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References (5)

Core 5

Scores

CVSS v3 6.4
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
wpxpo/WowStore – Store Builder & Product Blocks for WooCommerce < 4.4.24
Published Jul 29, 2026
Tracked Since Jul 29, 2026