CVE-2026-39750: WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

Q: Can an attacker exploit this without a WordPress account?

Yes. The vulnerability is rated with no privileges required and network attack vector, so authentication is not required for exploitation.

Q: Does exploitation require someone to take an action?

Yes. User interaction is required. A successful attack depends on a user interacting with attacker-controlled content or a malicious request.

Q: How can I determine whether my site is affected?

Check the installed version of the StoreGrowth plugin. Versions 2.0.6 and earlier are identified as affected.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

Affected Software

1 affected component

StoreGrowth Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart<=2.0.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/storegrowth-sales-booster to a version that resolves this vulnerability.
Fixed in 2.1.1

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Can an attacker exploit this without a WordPress account?

Yes. The vulnerability is rated with no privileges required and network attack vector, so authentication is not required for exploitation.

Does exploitation require someone to take an action?

Yes. User interaction is required. A successful attack depends on a user interacting with attacker-controlled content or a malicious request.

How can I determine whether my site is affected?

Check the installed version of the StoreGrowth plugin. Versions 2.0.6 and earlier are identified as affected.

CVE-2026-39750: WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Can an attacker exploit this without a WordPress account?

Does exploitation require someone to take an action?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Can an attacker exploit this without a WordPress account?

Does exploitation require someone to take an action?

How can I determine whether my site is affected?