Junglewise Threat Intelligence

CVE-2026-3574: uxdexperts Experto Dashboard for WooCommerce Stored XSS in settings

CVE-2026-3574 · Severity: medium · CVSS 4.4 · Published 2026-04-09

Executive brief

The Experto Dashboard for WooCommerce plugin for WordPress, which allows site owners to customize their store's dashboard, contains a security flaw in its settings page. An attacker with administrative privileges could save malicious scripts into settings like font sizes or weights. These scripts would then run in the browser of any user who visits the settings page, potentially leading to unauthorized actions or data theft. This issue primarily impacts WordPress multi-site environments or sites with specific security restrictions disabled.

Technical details

The Experto Dashboard for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and missing output escaping in several settings fields, including 'Navigation Font Size' and 'Heading Font Weight'. Specifically, the plugin fails to use a sanitize callback in register_setting() and lacks esc_attr() in the field_callback() printf output. Authenticated attackers with Administrator-level access can inject arbitrary web scripts that execute when a user accesses the settings page. This vulnerability is exploitable in multi-site installations or where unfiltered_html has been disabled. A patch was released in version 1.0.5.

Affected products

  • uxdexperts Experto Dashboard for WooCommerce up to and including 1.0.4

Timeline

  • 2026-04-09: advisory: Initial advisory published by Wordfence/NVD

References