CVE-2026-122673: WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ShopEngine pluginto a version that resolves this vulnerability.Fixed in 4.9.9
Event History
Frequently Asked Questions
Which installations are affected?
Wpmet ShopEngine versions through 4.9.8 are affected. The available data does not identify a safe fixed version.
What access does an attacker need to exploit this issue?
The CVSS vector indicates an attacker needs network access, low privileges, and user interaction. Exploitation is rated low complexity and can result in stored cross-site scripting.
What impact can successful exploitation have?
The reported impact includes low confidentiality, integrity, and availability effects, with scope changed. Because this is stored XSS, injected content may execute when another user views the affected page or content.