Executive brief
A vulnerability exists in a popular WordPress plugin used for managing store discounts and dynamic pricing. An attacker can trick a site administrator or visitor into clicking a malicious link, which then executes unauthorized code in their browser. This could lead to the theft of login sessions, unauthorized changes to the website, or the redirection of customers to malicious sites.
Technical details
The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw within the 'wdpAjax' AJAX action. The plugin fails to perform nonce validation or check user capabilities before processing requests to this endpoint. Furthermore, it reflects unsanitized user input directly back into the HTTP response. An unauthenticated attacker can exploit this by inducing a user (such as an administrator) to visit a specially crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 5.0.0.
Affected products
- Acowebs Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0
Timeline
- 2026-07-20: disclosed: Publicly published by WPScan
- 2026-08-01: advisory: NVD publication date
- 2026-08-01: patched: Fixed in version 5.0.0