CVE-2026-100316: WooCommerce VAT Plugin XSS Vulnerability

CVE-2026-100316 Overview

CVE-2026-100316 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the European VAT Compliance Assistant for WooCommerce plugin for WordPress in all versions up to and including 1.36.10. The plugin trusts the CF-IPCountry HTTP header during guest checkout and writes its value verbatim into order post-meta. Unauthenticated attackers can inject arbitrary web scripts that execute when administrators or users view the affected order pages. The flaw is tracked under CWE-79 and documented in the Wordfence Vulnerability Report.

Critical Impact
Unauthenticated attackers can plant persistent JavaScript payloads inside WooCommerce orders through a crafted HTTP header, enabling session theft, administrator account compromise, and WordPress backend takeover.

Affected Products

European VAT Compliance Assistant for WooCommerce plugin for WordPress
All versions up to and including 1.36.10
WordPress installations running WooCommerce with the vulnerable plugin active

Discovery Timeline

2026-10-17 - CVE-2026-100316 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-100316

Vulnerability Analysis

The European VAT Compliance Assistant for WooCommerce plugin reads the CF-IPCountry HTTP request header during the checkout workflow. Cloudflare adds this header to identify the originating country of a request, but any client can forge it when the WordPress origin is reachable without proxy enforcement. The plugin consumes the raw header value and writes it directly into order post-meta without sanitization or escaping. When a store operator views the order in the WooCommerce admin or any front-end page that renders this metadata, the stored payload executes in the browser context of the viewer. The relevant code paths are visible in bootstrap.php and record-order-details.php of the vulnerable branch, as referenced in the plugin source at line 1779 and record-order-details.php line 222.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping. The plugin treats a client-controlled HTTP header as trusted data and persists it verbatim into the WordPress database. There is no call to sanitize_text_field(), wp_kses(), or esc_html() on the write path, and the admin rendering path emits the value without escaping. This chain satisfies the preconditions for stored XSS under CWE-79.

Attack Vector

An unauthenticated attacker initiates a guest checkout against a WooCommerce store running the vulnerable plugin. The attacker sets the CF-IPCountry request header to a crafted value containing JavaScript, for example a <script> tag or an event handler attribute. The plugin stores the header value as order post-meta. When a store administrator opens the order in wp-admin, the browser parses and executes the injected script, enabling session hijacking, forced plugin installation, or privilege escalation to administrator. The fix is published in changeset #3713548, with the diff against the previous release available for review.

Detection Methods for CVE-2026-100316

Indicators of Compromise

Order post-meta entries whose stored CF-IPCountry value contains HTML tags, angle brackets, javascript: URIs, or on*= event handler attributes.
Inbound HTTP requests to checkout endpoints carrying a CF-IPCountry header longer than the expected two-letter ISO country code.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing a WooCommerce order.
WordPress users with newly elevated privileges or newly created administrator accounts without a corresponding audit entry.

Detection Strategies

Query the wp_postmeta table for VAT compliance meta keys containing characters outside the [A-Z]{2} pattern expected for an ISO country code.
Inspect web server and WAF logs for guest checkout POST requests with suspicious CF-IPCountry header payloads.
Deploy content security policy (CSP) violation reporting on wp-admin pages to catch script execution originating from inline order data.

Monitoring Recommendations

Enable file integrity monitoring on WordPress plugin directories to detect tampering tied to post-exploitation activity.
Alert on administrator session anomalies, including token reuse from new IP addresses or user agents immediately after order review.
Monitor WooCommerce admin page loads for inline <script> content served from stored meta fields.

How to Mitigate CVE-2026-100316

Immediate Actions Required

Upgrade the European VAT Compliance Assistant for WooCommerce plugin to the version released in changeset #3713548, which supersedes 1.36.10.
Audit existing WooCommerce orders for post-meta containing HTML or script content and purge malicious values.
Rotate administrator credentials and invalidate active sessions for any user who may have viewed a compromised order.

Patch Information

The vendor addressed CVE-2026-100316 after version 1.36.10. The code change is published in WordPress plugin changeset 3713548 and modifies record-order-details.php so that the CF-IPCountry header value is sanitized before being written to order post-meta. Administrators should install the patched release through the WordPress plugin updater and verify the active version after update.

Workarounds

Configure the web server or reverse proxy to strip or overwrite the CF-IPCountry header on inbound requests, allowing it only when sourced from trusted Cloudflare IP ranges.
Deploy a WAF rule that blocks checkout requests containing HTML special characters inside the CF-IPCountry header.
Temporarily deactivate the plugin on stores that cannot patch immediately and rely on an alternative VAT compliance mechanism.

bash

# Example nginx rule to drop forged CF-IPCountry headers from untrusted sources
map $http_cf_ipcountry $sanitized_cf_ipcountry {
    default "";
    "~^[A-Z]{2}$" $http_cf_ipcountry;
}

server {
    location / {
        proxy_set_header CF-IPCountry $sanitized_cf_ipcountry;
        proxy_pass http://wordpress_backend;
    }
}