CVE-2026-107711: FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint

Q: Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The plugin exposes a REST bearer token in the WordPress Dashboard page source without a capability check, and the affected REST endpoint relies on that token rather than verifying the user's current capability.

Q: What must an attacker do to trigger the vulnerability?

The attacker needs an authenticated account and access to the Dashboard page to obtain the exposed bearer token. They can then submit malicious script through the products[].post_content parameter to the REST update endpoint.

Q: When does the injected script execute?

The script is stored in page content and executes when a user accesses an injected page. This can affect other users who view the modified content.

Q: Are default low-privilege accounts affected?

Yes. Subscriber-level accounts are sufficient; an attacker does not need an administrative or editor-level role.

Published Oct 31, 2026

Updated

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].postcontent' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber-level user because the plugin's adminenqueuescripts callback exposes the REST bearer token in the Dashboard page source via wplocalizescript() without a capability check, and the REST endpoint's permissioncallback validates only that bearer token rather than performing a currentusercan() capability check.

Event History

Oct 31, 2026

CVE Published

via MITRE·09:29 AM

Data Sourced

via MITRE·09:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The plugin exposes a REST bearer token in the WordPress Dashboard page source without a capability check, and the affected REST endpoint relies on that token rather than verifying the user's current capability.

What must an attacker do to trigger the vulnerability?

The attacker needs an authenticated account and access to the Dashboard page to obtain the exposed bearer token. They can then submit malicious script through the products[].post_content parameter to the REST update endpoint.

When does the injected script execute?

The script is stored in page content and executes when a user accesses an injected page. This can affect other users who view the modified content.

Are default low-privilege accounts affected?

Yes. Subscriber-level accounts are sufficient; an attacker does not need an administrative or editor-level role.

CVE-2026-107711: FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint

Event History

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to trigger the vulnerability?

When does the injected script execute?

Are default low-privilege accounts affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What must an attacker do to trigger the vulnerability?

When does the injected script execute?

Are default low-privilege accounts affected?