CVE-2026-13725: WooCommerce Dynamic Pricing XSS Flaw

CVE-2026-13725 Overview

CVE-2026-13725 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin. The plugin fails to validate a nonce or verify user capabilities on one of its AJAX actions. It also reflects unsanitised user input directly into the HTTP response. Unauthenticated attackers can craft a malicious link that executes arbitrary JavaScript in the victim's browser session when clicked. All versions before 5.0.0 are affected.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser context, enabling session theft, privilege abuse, and further compromise of the WooCommerce store.

Affected Products

Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin versions before 5.0.0
WordPress installations running WooCommerce with the vulnerable plugin enabled
Any WooCommerce merchant environment exposing the affected AJAX endpoint

Discovery Timeline

2026-08-01 - CVE-2026-13725 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-13725

Vulnerability Analysis

The Dynamic Pricing With Discount Rules for WooCommerce plugin registers an AJAX action that accepts user-supplied input over the network. The handler omits two required checks: nonce validation via check_ajax_referer() and capability verification via current_user_can(). As a result, any unauthenticated visitor can invoke the endpoint. The handler then reflects portions of the request back in the response without sanitisation or output encoding.

An attacker crafts a URL or form submission containing JavaScript payloads in an affected parameter. When a victim, typically a logged-in administrator, is induced to send the request, the injected script executes in the context of the WordPress origin. This grants the attacker access to authenticated cookies, admin panel actions, and store data. User interaction is required, so social engineering via phishing or a malicious page is the typical delivery channel.

Root Cause

The root cause is two-fold. First, the AJAX action lacks authentication and authorization controls, exposing a privileged action to unauthenticated callers. Second, output from the reflected parameter is not passed through esc_html(), esc_attr(), or wp_kses() before being written to the response. This combination converts a routine AJAX handler into a reflected XSS sink.

Attack Vector

The attack vector is network-based with required user interaction. An attacker delivers a crafted link to a WordPress administrator through email, chat, or a compromised web page. The victim's browser sends the request to the vulnerable AJAX endpoint on the target site. The server echoes the malicious payload, and the browser executes it under the site's origin. Because the scope changes (S:C), the impact extends beyond the vulnerable component to the entire WordPress admin session.

See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-13725

Indicators of Compromise

Unexpected admin-ajax.php requests containing HTML tags, <script> markup, or URL-encoded JavaScript in query parameters
Outbound requests from administrator sessions to unfamiliar domains shortly after clicking external links
New or modified WordPress administrator accounts, plugins, or theme files following suspicious AJAX traffic
Browser console errors or CSP violations logged on admin pages referencing the plugin

Detection Strategies

Inspect web server access logs for admin-ajax.php POST or GET requests referencing the plugin's AJAX action name with reflected input parameters containing script syntax
Deploy a Web Application Firewall (WAF) rule that flags common XSS payloads such as <script, onerror=, javascript:, and encoded variants targeting the plugin endpoint
Correlate administrator authentication events with anomalous AJAX request patterns to identify targeted phishing

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM for retention and query
Alert on responses from admin-ajax.php that contain reflected input matching request parameters
Monitor administrator user-agent and IP consistency to detect session hijacking following an XSS payload

How to Mitigate CVE-2026-13725

Immediate Actions Required

Update the Dynamic Pricing With Discount Rules for WooCommerce plugin to version 5.0.0 or later
Audit administrator accounts for unauthorized changes made since the plugin was installed
Force password resets and invalidate active sessions for all WordPress administrators
Instruct administrators to avoid clicking untrusted links while authenticated to the WordPress admin console

Patch Information

The vendor addressed the vulnerability in version 5.0.0 of the plugin. The fix introduces nonce validation and capability checks on the affected AJAX action and sanitises user input before reflecting it in the response. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Dynamic Pricing With Discount Rules for WooCommerce plugin until it can be updated to version 5.0.0
Deploy a WAF rule to block requests to the vulnerable AJAX action containing HTML or JavaScript syntax in parameters
Enforce a strict Content Security Policy (CSP) on the WordPress site to limit inline script execution
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible

bash

# Example WAF rule (ModSecurity) blocking reflected XSS payloads to admin-ajax.php
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026013725,\
   msg:'Potential XSS targeting vulnerable WooCommerce plugin AJAX action'"
  SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"