Executive brief
A security vulnerability exists in the Smart Manager WordPress plugin, which is used by store owners to manage products and posts in bulk. A user with basic contributor access can inject malicious scripts into post fields that trigger when an administrator views the management dashboard. This could allow an attacker to perform unauthorized actions with administrative privileges, potentially compromising the website's data or configuration.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Smart Manager plugin due to improper encoding of post fields (such as the post title) before rendering them into HTML attributes within the management grid. The client-side renderer concatenates these fields into attributes like 'title' using innerHTML without sufficient sanitization. An attacker with Contributor-level privileges can craft a post title containing double quotes to break out of the HTML attribute and inject event handlers (e.g., onmouseover). When an administrator views the 'Posts' module in the Smart Manager dashboard and interacts with the grid, the injected script executes in their session. This issue is fixed in version 8.92.0.
Affected products
- StoreApps Smart Manager for WooCommerce < 8.92.0
Timeline
- 2026-02-13: disclosed: Initial discovery/disclosure date mentioned in references
- 2026-07-06: advisory: WPScan advisory published
- 2026-07-27: advisory: NVD record published