CVE-2026-1381: WooCommerce Order Limits XSS Vulnerability

CVE-2026-1381 Overview

The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.6.8. The vulnerability exists due to insufficient input sanitization and output escaping in the plugin's settings functionality. This allows authenticated attackers with Shop Manager-level permissions or above to inject arbitrary web scripts into pages that execute whenever a user accesses the affected page.

Critical Impact

Authenticated attackers with Shop Manager privileges can inject persistent malicious scripts that execute in the context of other users' sessions, potentially leading to credential theft, session hijacking, or administrative account compromise on WordPress multi-site installations.

Affected Products

• Order Minimum/Maximum Amount Limits for WooCommerce plugin versions up to and including 4.6.8
• WordPress multi-site installations with the affected plugin
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-01-28 - CVE-2026-1381 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1381

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability affects the Order Minimum/Maximum Amount Limits for WooCommerce plugin's settings handling mechanism. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents a failure to properly sanitize user-controllable input before it is rendered in web pages.

The attack requires authenticated access with Shop Manager-level privileges or higher, which limits the pool of potential attackers. However, the scope is changed (cross-site), meaning successful exploitation can impact resources beyond the vulnerable component's security scope. The vulnerability specifically affects multi-site WordPress installations and single-site installations where the unfiltered_html capability has been explicitly disabled.

When exploited, the injected scripts persist in the database and execute whenever legitimate users—including administrators—access the affected pages. This persistence makes the attack particularly dangerous as it can affect multiple users over an extended period without requiring continued attacker interaction.

Root Cause

The root cause of this vulnerability lies in insufficient input sanitization and output escaping within the plugin's settings handling code. The vulnerable code path exists in the class-alg-wc-oma-core.php file around line 86 and in the settings configuration file class-alg-wc-oma-settings-general.php. User-supplied input through the plugin settings is stored without proper sanitization and later rendered on pages without adequate output escaping, allowing JavaScript code to execute in users' browsers.

Attack Vector

The attack is network-based and requires an authenticated attacker with Shop Manager-level permissions or higher. The attacker must navigate to the plugin's settings page within the WordPress admin panel and inject malicious JavaScript code into one of the vulnerable settings fields.

The vulnerability specifically targets WordPress multi-site installations or configurations where unfiltered_html has been disabled. In standard WordPress single-site installations with default configurations, users with Shop Manager roles may already have the unfiltered_html capability, which would allow them to insert arbitrary HTML anyway—making this vulnerability less impactful in those scenarios.

The injected script executes whenever any user views a page that renders the compromised settings data, potentially allowing the attacker to steal session cookies, redirect users to malicious sites, modify page content, or perform actions on behalf of the victim.

Detection Methods for CVE-2026-1381

Indicators of Compromise

• Presence of unexpected JavaScript or HTML tags in plugin settings values stored in the WordPress database
• Unusual script execution or browser behavior when accessing WooCommerce-related pages
• Audit logs showing Shop Manager accounts modifying Order Minimum/Maximum Amount Limits settings unexpectedly
• Reports from users experiencing redirects or seeing unexpected content on WooCommerce pages

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and prevent inline script execution
• Monitor WordPress audit logs for modifications to the Order Minimum/Maximum Amount Limits plugin settings
• Use web application firewalls (WAF) to detect XSS payload patterns in HTTP requests targeting the plugin settings
• Regularly scan plugin settings and database fields for suspicious JavaScript or HTML content

Monitoring Recommendations

• Enable comprehensive logging for all WordPress admin panel activities, especially plugin configuration changes
• Configure alerts for settings modifications made by Shop Manager accounts
• Deploy browser-based XSS detection tools for administrative users
• Review access logs for unusual patterns of activity from accounts with Shop Manager privileges

How to Mitigate CVE-2026-1381

Immediate Actions Required

• Update the Order Minimum/Maximum Amount Limits for WooCommerce plugin to a version newer than 4.6.8
• Audit current plugin settings for any suspicious or unexpected content containing script tags or JavaScript
• Review Shop Manager account activity logs for unauthorized configuration changes
• Temporarily restrict plugin settings access to only trusted administrator accounts

Patch Information

A fix for this vulnerability is available in plugin versions after 4.6.8. The patch addresses the insufficient input sanitization and output escaping issues in the settings handling code. The specific changeset containing the fix can be reviewed in the WordPress Plugin Changeset Details.

Additional technical details are available in the Wordfence Vulnerability Analysis.

Workarounds

• Restrict Shop Manager role capabilities to prevent access to plugin settings until patching is complete
• Implement Web Application Firewall (WAF) rules to filter XSS payloads in requests to the plugin settings endpoints
• On multi-site installations, review and restrict which sites have the plugin activated
• Consider temporarily disabling the plugin if it is not critical to business operations until the update can be applied

# WordPress CLI command to update the plugin
wp plugin update order-minimum-amount-for-woocommerce

# Verify the installed version after update
wp plugin get order-minimum-amount-for-woocommerce --field=version