CVE-2026-13440: WordPress StoreGrowth Plugin XSS Flaw

CVE-2026-13440 Overview

CVE-2026-13440 is a stored Cross-Site Scripting (XSS) vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce WordPress plugin. The flaw affects all versions up to and including 2.1.0. Unauthenticated attackers can inject arbitrary JavaScript through the message_popup parameter due to insufficient input sanitization and output escaping. The exploit is possible because the ajd_protected nonce required by the create_popup handler is exposed to all unauthenticated frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce, bypassing the intended access control. Injected scripts execute in the browser of any visitor who accesses an affected page, enabling session theft, credential harvesting, and administrative account takeover [CWE-79].

Critical Impact
Unauthenticated attackers can persistently inject malicious JavaScript into WooCommerce storefronts, executing in every visitor's browser including site administrators.

Affected Products

StoreGrowth: Smart Sales Booster for WooCommerce plugin for WordPress, versions ≤ 2.1.0
WordPress sites running the storegrowth-sales-booster plugin with the BOGO module enabled
WooCommerce stores exposing the sales-pop AJAX handlers to unauthenticated visitors

Discovery Timeline

2026-07-28 - CVE-2026-13440 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-13440

Vulnerability Analysis

The vulnerability resides in the sales-pop AJAX handler create_popup, which processes the message_popup parameter without adequate sanitization or output escaping. Attacker-supplied HTML and JavaScript payloads persist to the database and render on frontend pages where the popup component loads. Any visitor, including authenticated administrators, executes the injected script in their browser session. This enables cookie theft, session hijacking, unauthorized administrative actions via CSRF-like flows, and drive-by redirection to attacker-controlled infrastructure. Because the persisted payload affects every viewer of the page, the impact scales with site traffic and includes privileged users who visit the storefront.

Root Cause

Two weaknesses combine to produce the exploit. First, the message_popup value flowing into Ajax.phpcreate_popup is stored and later emitted without proper escaping in popup-custom.js. Second, the ajd_protected nonce enforced by the handler is not a valid authorization boundary because EnqueueScript.php publishes it to every unauthenticated frontend visitor through wp_localize_script as bogo_save_url.ajd_nonce. The nonce-only access model provides no meaningful restriction when the nonce is publicly readable.

Attack Vector

An unauthenticated remote attacker retrieves any public page of the WordPress site to obtain the bogo_save_url.ajd_nonce value from the enqueued JavaScript context. The attacker then issues an AJAX POST request to the create_popup action containing the harvested nonce and a message_popup field holding an arbitrary script payload. The payload is stored server-side and rendered to subsequent visitors, achieving stored XSS with no authentication and no user interaction. Technical details are available in the Wordfence Vulnerability Report and the plugin source at EnqueueScript.php and Ajax.php.

Detection Methods for CVE-2026-13440

Indicators of Compromise

POST requests to admin-ajax.php with action=create_popup originating from unauthenticated sources
Popup records in the plugin's database entries containing <script>, onerror=, onload=, javascript:, or encoded script fragments in the message_popup field
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that render the sales-pop widget
New or modified administrator accounts, plugin installations, or theme changes shortly after popup content was updated

Detection Strategies

Inspect the WordPress database table storing popup content for HTML tags or JavaScript event handlers in message_popup values
Review web server access logs for POSTs to wp-admin/admin-ajax.php with action=create_popup from anonymous sessions
Scan rendered frontend HTML for unauthorized <script> blocks associated with the sales-pop module
Correlate storefront page views with subsequent privileged actions in wp-admin to identify possible session hijacking

Monitoring Recommendations

Alert on any anonymous invocation of plugin AJAX actions that were intended to be privileged operations
Monitor plugin version inventory across WordPress fleets and flag installations of storegrowth-sales-booster at version ≤ 2.1.0
Enable Content Security Policy (CSP) reporting to detect script-source violations produced by injected payloads

How to Mitigate CVE-2026-13440

Immediate Actions Required

Update the StoreGrowth: Smart Sales Booster for WooCommerce plugin to a version newer than 2.1.0 once the vendor publishes a fixed release
Audit stored popup content in the database and remove any entries containing script tags or JavaScript event handlers
Rotate administrator credentials and invalidate active WordPress sessions if unauthorized popup entries are discovered
Review the plugin changeset log to confirm the fixed version and applied patch

Patch Information

At time of publication, the vulnerability affects all versions up to and including 2.1.0. Administrators should monitor the WordPress plugin repository for a patched release addressing both the missing output escaping in the create_popup handler and the exposure of the ajd_protected nonce via wp_localize_script.

Workarounds

Deactivate and remove the storegrowth-sales-booster plugin until a patched version is available
Restrict access to admin-ajax.php for the create_popup action through a web application firewall rule blocking unauthenticated POSTs containing script payloads in message_popup
Deploy a strict Content Security Policy that disallows inline scripts on frontend pages to reduce the impact of successful injection

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS:action "@streq create_popup" \
    "id:1026134401,phase:2,deny,status:403,\
    msg:'Block unauthenticated StoreGrowth create_popup XSS attempt',\
    chain"
    SecRule ARGS:message_popup "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none"