CVE-2026-17161 Overview
CVE-2026-17161 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 4.4.24. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript through the filterMobileText block attribute. Injected scripts execute in the browser of any user visiting an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's Gutenberg block rendering pipeline.
Critical Impact
Contributor-level attackers can persist JavaScript payloads that execute in the sessions of site visitors and administrators, enabling session theft, forced administrative actions, and content manipulation.
Affected Products
- WowStore – Store Builder & Product Blocks for WooCommerce (WordPress plugin)
- All plugin versions up to and including 4.4.24
- WordPress sites running WooCommerce with the affected plugin installed
Discovery Timeline
- 2026-07-29 - CVE-2026-17161 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17161
Vulnerability Analysis
The vulnerability affects the WowStore plugin's product filter block, specifically the handling of the filterMobileText attribute. Contributor-level users can create or edit posts and pages that embed WowStore Gutenberg blocks. When a contributor sets a malicious value on the filterMobileText attribute, that value is persisted inside the post content as JSON within a Gutenberg block delimiter comment. On page render, the plugin's render_callback reads the attribute and outputs it into HTML without adequate escaping, executing attacker-controlled script in the visitor's browser.
Root Cause
The root cause is a mismatch between save-time sanitization and render-time output escaping. WordPress applies wp_kses_post at save time, but the payload is stored inside a Gutenberg block delimiter comment as JSON. wp_kses_post treats HTML comments as opaque and preserves their contents, so an attribute-breakout string survives intact. When the server-side render_callback later interpolates the attribute into HTML markup, the payload escapes the intended attribute context and executes as script. See the WordPress Product Grid Code, WordPress Filter Template Code, and WordPress Functions Code for the affected code paths.
Attack Vector
Exploitation requires an authenticated account with contributor privileges or higher. The attacker inserts a WowStore product filter block into a post and manipulates the filterMobileText attribute value with an attribute-breakout payload. Once the post is submitted for review or published, any user rendering the page triggers script execution. The attack requires no user interaction beyond visiting the affected page. The scope change in the CVSS vector reflects impact on browser sessions outside the plugin's trust boundary.
No verified exploit code is publicly available. See the Wordfence Vulnerability Report for further technical details.
Detection Methods for CVE-2026-17161
Indicators of Compromise
- Post or page content containing wp:product-blocks or WowStore block delimiter comments with suspicious JSON attribute values such as filterMobileText containing quote characters, angle brackets, or on* event handler strings.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that embed WowStore blocks.
- Newly created or modified posts by contributor-role accounts that include WowStore filter blocks.
Detection Strategies
- Scan the wp_posts table for block comment strings containing filterMobileText combined with characters such as ", <, >, or javascript:.
- Review WordPress audit logs for contributor-level accounts creating or editing content that includes WowStore Gutenberg blocks.
- Deploy a Web Application Firewall (WAF) rule to inspect rendered HTML for reflected filterMobileText values that break attribute context.
Monitoring Recommendations
- Monitor wp-admin/post.php and REST API /wp/v2/posts requests submitting WowStore block payloads from non-administrative roles.
- Alert on browser Content Security Policy (CSP) violation reports referencing inline script execution on pages using the plugin.
- Track plugin version inventory across WordPress sites and flag any host running WowStore 4.4.24 or earlier.
How to Mitigate CVE-2026-17161
Immediate Actions Required
- Update the WowStore – Store Builder & Product Blocks for WooCommerce plugin to a version later than 4.4.24 as soon as the vendor patch is available.
- Audit all contributor, author, and editor accounts and remove any that are not actively required.
- Review recently published or pending posts for WowStore blocks containing suspicious filterMobileText values and sanitize or delete them.
Patch Information
The vendor addressed the issue in a code change tracked in the plugin repository. Refer to the WordPress Change Set Details for the fix and upgrade to the patched release identified in the Wordfence Vulnerability Report.
Workarounds
- Restrict content creation on WordPress sites to trusted administrator and editor accounts until the plugin is updated.
- Deploy a WAF signature that blocks POST requests containing filterMobileText attribute values with HTML-breaking characters.
- Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of injected payloads.
- Temporarily deactivate the WowStore plugin on sites that cannot be immediately patched.
# Configuration example: enforce Content Security Policy in .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
