CVE-2026-17161 in WowStore Plugin
Summary
by MITRE • 07/29/2026
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post sanitization is ineffective because the payload is stored inside a Gutenberg block delimiter comment as JSON, which wp_kses_post preserves, allowing an attribute-breakout string to survive to the server-side render_callback.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
The WowStore plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects versions through 4.4.24, representing a significant security risk for WordPress installations. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's implementation, specifically targeting the 'filterMobileText' block attribute. The flaw enables authenticated attackers holding contributor-level privileges or higher to inject malicious scripts that execute whenever users access pages containing the injected content, creating a persistent threat vector that can compromise user sessions and data integrity.
The technical exploitation of this vulnerability occurs through the manipulation of Gutenberg block delimiters where JSON-encoded payloads are stored within comment sections. The wp_kses_post sanitization function, which normally provides protection against malicious content, proves ineffective in this scenario because it preserves the attribute-breakout strings found within these comment-based storage mechanisms. This bypass allows attackers to craft payloads that survive server-side processing and are subsequently rendered in the browser context, creating a direct path for script execution. The vulnerability specifically targets the render_callback function that processes block attributes, enabling attackers to inject JavaScript code that executes in the context of authenticated users.
The operational impact of this stored XSS vulnerability extends beyond simple script execution, as it provides attackers with the ability to perform session hijacking, deface websites, steal user credentials, and potentially escalate privileges within the WordPress environment. Attackers can leverage this vulnerability to create persistent backdoors, manipulate content, or redirect users to malicious sites for phishing attacks. The low privilege requirement of contributor-level access makes this vulnerability particularly dangerous as it can be exploited by users who typically have limited administrative capabilities, potentially allowing for unauthorized modifications to website content and structure.
Security mitigations for this vulnerability should focus on implementing proper input validation and output escaping mechanisms specifically for Gutenberg block attributes. The plugin developers must ensure that all user-provided content within block delimiters undergoes strict sanitization before storage, with particular attention to JSON-encoded data structures. Implementing Content Security Policy headers can provide additional defense-in-depth measures, while regular security audits of block attribute handling should be conducted to identify similar vulnerabilities. Organizations should also consider restricting contributor-level access to block editing capabilities where possible, and implementing monitoring solutions to detect unusual content modifications that may indicate exploitation attempts.
This vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, which addresses the failure to properly sanitize user input before incorporating it into web pages. The attack pattern follows ATT&CK technique T1566.002: Phishing: Spearphishing Attachment, as malicious payloads can be delivered through compromised content that appears legitimate to users. Additionally, this issue demonstrates characteristics of T1059.001: Command and Scripting Interpreter: PowerShell, where attackers can leverage the XSS capability to execute malicious scripts in user browsers, potentially leading to further compromise through credential theft or additional attack vectors.
The exploitation chain begins with an authenticated attacker creating malicious content within the plugin's block system, storing it in a manner that bypasses standard sanitization filters. The stored payload then executes during page rendering when users access affected pages, typically through user-facing interfaces where the content is displayed. This creates a persistent threat that can affect any user who views the compromised content, making it particularly dangerous for plugins with widespread usage and contributor-level access permissions. The vulnerability's persistence across user sessions and page views makes it an attractive target for attackers seeking long-term access to WordPress installations.
Organizations should immediately update to patched versions of the WowStore plugin when available, while implementing network monitoring solutions to detect potential exploitation attempts. Regular security assessments of WordPress plugins should include evaluation of block attribute handling and sanitization processes to identify similar vulnerabilities. The incident highlights the importance of proper input validation in modern web applications, particularly those utilizing component-based frameworks like Gutenberg where content can be stored in complex data structures that may bypass traditional security measures.