Executive brief
WowStore is a WordPress plugin used to build e-commerce storefronts for WooCommerce. A security flaw allows users with low-level editing permissions (like contributors) to embed malicious scripts into store pages. These scripts will automatically run in the browser of any visitor who views the affected page, potentially leading to unauthorized actions or data theft.
Technical details
The WowStore plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the 'filterMobileText' block attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into Gutenberg blocks. The standard WordPress 'wp_kses_post' sanitization is bypassed because the payload is stored as JSON within a block delimiter comment, which is then rendered without proper escaping via a server-side callback. This allows the script to execute in the context of any user viewing the page. The issue is addressed in versions following 4.4.24.
Affected products
- wpxpo WowStore – Store Builder & Product Blocks for WooCommerce up to, and including, 4.4.24
Timeline
- 2026-07-29: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/product-blocks/trunk/blocks/Product_Grid_1.php
- https://plugins.trac.wordpress.org/browser/product-blocks/trunk/blocks/template/filter.php
- https://plugins.trac.wordpress.org/browser/product-blocks/trunk/classes/Functions.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3625492%40product-blocks&new=3625492%40product-blocks
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fae39bf9-8ceb-4cb1-afd1-522c885e6ef5?source=cve