CVE-2026-17162: WowStore WordPress Plugin XSS Vulnerability

CVE-2026-17162 Overview

CVE-2026-17162 is a Stored Cross-Site Scripting (XSS) vulnerability in the WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 4.4.24. The plugin fails to properly sanitize input and escape output on the currentPostId block attribute, allowing authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any user who visits an affected page. The issue is tracked under [CWE-79] and stems from insufficient handling of user-supplied block attributes in the plugin's Filter.php component.

Critical Impact

Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, administrative action forgery, and site defacement against any visitor.

Affected Products

• WowStore – Store Builder & Product Blocks for WooCommerce (WordPress plugin)
• All versions up to and including 4.4.24
• WordPress sites where contributor-level accounts or higher can author content using the plugin's blocks

Discovery Timeline

• 2026-07-29 - CVE-2026-17162 published to NVD
• 2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17162

Vulnerability Analysis

The vulnerability resides in the WowStore plugin's Filter block implementation, specifically in blocks/Filter.php at lines 97, 116, and 136 in version 4.4.24. The block accepts a currentPostId attribute from user-supplied block data. The plugin renders this attribute back into page HTML without applying WordPress escaping functions such as esc_attr() or esc_html(). Because Gutenberg block attributes are stored with post content, an authenticated user who can create or edit posts controls the value written to the database. When any visitor loads the resulting page, the browser parses the injected markup and executes attacker-controlled JavaScript in the site's origin.

Root Cause

The root cause is missing input sanitization on ingestion and missing output escaping on render for the currentPostId block attribute. WordPress requires plugins to sanitize block attribute values against an expected type (an integer in this case) and to escape all dynamic values before emitting HTML. The affected Filter.php render path performs neither step, allowing arbitrary strings, including HTML and script payloads, to flow from block JSON directly into the page DOM. This is a classic Stored XSS pattern in Gutenberg block plugins.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or above. The attacker inserts a WowStore Filter block into a post or page and manipulates the block's JSON to set currentPostId to a payload containing HTML attribute-breaking characters and script content. After the post is saved and later viewed, either by an administrator during review or by public visitors after publication, the payload executes in the victim's session context. Because the scope is changed (S:C), scripts run against the WordPress site origin and can perform actions on behalf of higher-privileged users who view the injected page.

No public proof-of-concept code has been published. See the Wordfence Vulnerability Report and the WordPress Filter.php Code Review for the affected source lines.

Detection Methods for CVE-2026-17162

Indicators of Compromise

• Post or page content containing WowStore Filter block markup with non-numeric values in the currentPostId attribute.
• Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs within saved block JSON in the wp_posts.post_content table.
• Outbound browser requests from authenticated admin sessions to unfamiliar domains shortly after viewing pages containing WowStore blocks.
• Contributor-level accounts editing or creating posts that embed Filter blocks outside normal editorial patterns.

Detection Strategies

• Query the WordPress database for posts containing the WowStore Filter block and inspect currentPostId values for anything other than integers.
• Enable and review WordPress audit logs for post revisions authored by contributor accounts that add or modify block attributes.
• Deploy a Web Application Firewall rule that inspects POST requests to /wp-json/wp/v2/posts and admin-ajax.php for block payloads containing HTML tags in numeric attribute fields.

Monitoring Recommendations

• Alert on new or modified user accounts with the contributor role and correlate with subsequent post creation events.
• Monitor server logs for anomalous requests to pages rendering WowStore blocks, particularly those preceded by session cookies belonging to administrators.
• Track plugin version inventory across WordPress deployments and flag any host running WowStore at 4.4.24 or earlier.

How to Mitigate CVE-2026-17162

Immediate Actions Required

• Update the WowStore – Store Builder & Product Blocks for WooCommerce plugin to a version newer than 4.4.24 as soon as the vendor patch is available.
• Audit contributor, author, and editor accounts and remove or disable any that are unnecessary or inactive.
• Scan existing posts and pages for WowStore Filter blocks and remove any containing suspicious currentPostId values.
• Rotate administrator session cookies and passwords if compromise is suspected.

Patch Information

The vendor addressed the issue in the plugin repository. Review the WordPress Product Blocks Changeset for the exact code changes applied to Filter.php. Administrators should install the fixed release through the WordPress plugin manager or by replacing the plugin files with the patched version.

Workarounds

• Restrict use of the WowStore plugin blocks to trusted editor and administrator accounts by removing the edit_posts capability from untrusted contributor roles until the patch is applied.
• Deactivate the WowStore plugin on production sites that do not require Store Builder blocks until an update is installed.
• Deploy a WAF rule to reject requests where WooCommerce block JSON contains angle brackets, quotes, or javascript: sequences in numeric attributes.
• Apply a Content Security Policy that disallows inline scripts to reduce the impact of stored payloads.

# Example WP-CLI commands to inventory and mitigate
wp plugin get product-blocks --field=version
wp plugin deactivate product-blocks
wp user list --role=contributor --fields=ID,user_login,user_registered
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%wp:product-blocks/filter%' AND post_content REGEXP 'currentPostId\":\"[^0-9]';"