CVE-2026-17162 in WowStore Plugin
Summary
by MITRE • 07/29/2026
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The WowStore plugin for WordPress represents a significant security vulnerability through its stored cross-site scripting flaw in version 4.4.24 and earlier. This vulnerability specifically targets the 'currentPostId' block attribute within the plugin's store builder functionality, creating a persistent threat that can be exploited by authenticated users possessing contributor-level privileges or higher. The flaw stems from inadequate input sanitization measures and insufficient output escaping mechanisms that fail to properly validate or escape user-supplied data before it is stored in the database and subsequently rendered on web pages.
The technical implementation of this vulnerability allows malicious actors with minimal privilege levels to inject arbitrary JavaScript code into WordPress posts or pages through the plugin's block attribute system. When legitimate users access pages containing the injected content, their browsers execute the malicious scripts without proper context or security boundaries. This stored XSS vector operates by bypassing standard WordPress sanitization filters and escaping mechanisms that should normally prevent such malicious code from persisting in the content management system. The vulnerability exists because the plugin fails to implement proper contextual output escaping for different execution contexts including html, javascript, and attribute contexts.
From an operational perspective, this vulnerability presents a substantial risk to WordPress sites utilizing the WowStore plugin, as it enables attackers to establish persistent backdoors or execute malicious activities within the context of authenticated user sessions. The impact extends beyond simple script execution to potential session hijacking, data exfiltration, and privilege escalation attacks that could compromise entire websites. Attackers can leverage this vulnerability to inject scripts that steal cookies, redirect users to malicious sites, or modify content in ways that undermine site integrity and user trust. The persistent nature of stored XSS means that once injected, the malicious code remains active until manually removed from the database.
Security professionals should immediately implement mitigations including immediate plugin updates to versions that address this vulnerability, proper input validation and sanitization for all user-supplied data, and comprehensive output escaping for all dynamic content. Organizations must also consider implementing web application firewalls to detect and block suspicious script injection attempts, while conducting thorough security audits of all installed plugins to identify similar vulnerabilities. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and follows ATT&CK technique T1566 for initial access through malicious content. Regular security monitoring and user access reviews are essential to prevent unauthorized privilege escalation and maintain the integrity of WordPress installations that rely on third-party plugins for core functionality.