CVE-2026-104727: Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with contributor-level access or higher. The issue affects plugin versions through 3.6.5.
What is required for the injected script to execute?
The attacker must inject script through the condition post-meta array keys. The script executes when a user visits a page containing the injected content.
Is this exploitable without logging in?
No. The stated attack requirements include authenticated WordPress access with at least the Contributor role.