CVE-2026-103899: EU VAT Assistant WooCommerce XSS Vulnerability

CVE-2026-103899 Overview

CVE-2026-103899 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the EU VAT Assistant for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 2.1.30.260413 and stems from insufficient input sanitization and output escaping on the vat_number parameter. Unauthenticated attackers can inject arbitrary JavaScript that persists in order records. The payload executes in the administrator's browser when they view an order through WooCommerce → Orders → Edit Order. Successful exploitation enables privilege escalation, including creation of rogue administrator accounts and full site takeover. The weakness is tracked as CWE-79.

Critical Impact
Unauthenticated stored XSS leading to administrator account compromise and full WordPress site takeover.

Affected Products

EU VAT Assistant for WooCommerce plugin for WordPress
All plugin versions up to and including 2.1.30.260413
WordPress sites running WooCommerce with the vulnerable plugin enabled

Discovery Timeline

2026-10-17 - CVE-2026-103899 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-103899

Vulnerability Analysis

The vulnerability resides in how the EU VAT Assistant for WooCommerce plugin processes the vat_number field submitted during checkout. The plugin stores the value against the order record without applying sufficient input sanitization. When an administrator later opens the order in the WooCommerce admin screen, the stored value is rendered without proper output escaping. Any JavaScript embedded in the VAT number field executes inside the administrator's authenticated session.

Because the attack vector is network-based and requires no authentication or user interaction from the attacker side, any guest checkout path that accepts an EU VAT number becomes an injection sink. The admin review action triggers execution, which satisfies the user-interaction requirement on the victim side.

Root Cause

The root cause is a missing sanitization and escaping boundary across the storage and rendering flow. The plugin accepts the vat_number parameter during order creation, writes it to order metadata, and later echoes it inside the admin order view template referenced in order-vat-info-box.php. Neither the write path in the orders integration layer nor the read path applies esc_html(), esc_attr(), or equivalent WordPress escaping APIs.

Attack Vector

An unauthenticated attacker places an order on the target WooCommerce store and supplies a crafted JavaScript payload in the VAT number field instead of a valid EU VAT identifier. The plugin's VAT number validator does not strip script content. The payload is persisted with the order. When a store administrator opens the order, the script executes with administrator privileges, allowing creation of a new administrator user, theft of session cookies, or injection of malicious content into the site. Full technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-103899

Indicators of Compromise

Order metadata containing HTML tags, <script> elements, or JavaScript event handlers in the vat_number field
Unexpected WordPress administrator accounts created without a corresponding audit trail
New or modified plugin, theme, or mu-plugins files appearing after an administrator viewed an order
Outbound HTTP requests from admin browser sessions to unfamiliar domains after accessing WooCommerce order pages

Detection Strategies

Query WooCommerce order metadata for the _vat_number key and flag entries containing <, >, javascript:, or on event handler substrings
Review WordPress wp_users and wp_usermeta tables for recently created accounts with the administrator role
Inspect web server access logs for POST requests to WooCommerce checkout endpoints submitting non-conforming VAT number values

Monitoring Recommendations

Enable WordPress audit logging for user creation, role changes, and plugin or theme modifications
Monitor administrator session activity for anomalous XHR or fetch calls originating from order edit screens
Alert on changes to the wp-config.php file and the wp-content/plugins/ directory

How to Mitigate CVE-2026-103899

Immediate Actions Required

Deactivate the EU VAT Assistant for WooCommerce plugin until a patched release is confirmed and installed
Audit WooCommerce orders for suspicious vat_number values and purge any containing script content
Rotate credentials for all WordPress administrator accounts and invalidate active sessions
Review installed plugins, themes, and administrator user list for unauthorized additions

Patch Information

At the time of publication the enriched CVE record does not list a fixed version. Monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for release notes beyond version 2.1.30.260413. Apply the vendor fix as soon as it becomes available.

Workarounds

Place a Web Application Firewall (WAF) rule that blocks checkout submissions where the vat_number parameter contains <, >, or javascript: tokens
Restrict access to the WooCommerce admin order screens to administrators using hardware-backed multi-factor authentication
Deploy a strict Content Security Policy (CSP) on /wp-admin/ that disallows inline scripts and untrusted script sources
Temporarily disable guest checkout or require customer account verification before orders are persisted

bash

# Example WAF rule concept (ModSecurity) to block script-like VAT numbers
SecRule ARGS:vat_number "@rx (?i)(<script|javascript:|on[a-z]+\s*=)" \
  "id:1039899,phase:2,deny,status:403,log,msg:'Blocked XSS in vat_number (CVE-2026-103899)'"