CVE-2026-24526: WooCommerce Email Inquiry XSS Vulnerability

CVE-2026-24526 Overview

A DOM-Based Cross-Site Scripting (XSS) vulnerability has been identified in the Email Inquiry & Cart Options for WooCommerce plugin developed by Steve Truman. This vulnerability allows attackers to inject malicious scripts that execute within the context of a victim's browser session, potentially leading to session hijacking, credential theft, or further attacks against the WordPress site and its users.

Critical Impact

Authenticated attackers with low privileges can exploit this DOM-Based XSS vulnerability to execute arbitrary JavaScript in victims' browsers, potentially compromising user sessions, stealing sensitive data, or performing actions on behalf of authenticated administrators.

Affected Products

• Email Inquiry & Cart Options for WooCommerce plugin versions through 3.4.3
• WordPress sites running the vulnerable woocommerce-email-inquiry-cart-options plugin
• WooCommerce stores utilizing the Email Inquiry & Cart Options functionality

Discovery Timeline

• 2026-01-23 - CVE-2026-24526 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2026-24526

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as a DOM-Based XSS attack. Unlike reflected or stored XSS, DOM-Based XSS occurs entirely on the client-side where the malicious payload is processed by JavaScript code that reads data from the DOM and writes it back without proper sanitization.

In the context of the Email Inquiry & Cart Options for WooCommerce plugin, user-supplied input is processed by client-side JavaScript and rendered into the page DOM without adequate encoding or validation. This allows an attacker to craft malicious input that, when processed by the vulnerable JavaScript code, executes arbitrary scripts in the victim's browser context.

The attack requires user interaction (the victim must visit a specially crafted URL or interact with malicious content), and the attacker needs low-level privileges on the WordPress installation to exploit this vulnerability effectively.

Root Cause

The root cause of this vulnerability lies in the plugin's failure to properly sanitize and encode user-controlled input before it is dynamically written into the DOM. The JavaScript code within the woocommerce-email-inquiry-cart-options plugin reads input from URL parameters, form fields, or other user-controllable sources and renders them directly into the page without applying proper output encoding, enabling script injection.

Attack Vector

The attack is network-accessible and requires an authenticated user with low privileges. The exploitation flow typically involves:

1. An attacker crafts a malicious URL or input containing JavaScript payload
2. The victim, while authenticated to the WordPress site, clicks the malicious link or interacts with the crafted content
3. The plugin's JavaScript processes the malicious input and writes it to the DOM
4. The injected script executes in the victim's browser with access to their session cookies and authentication tokens
5. The attacker can then steal session data, perform CSRF attacks, or redirect the user to phishing pages

The vulnerability allows for scope change, meaning the attack can affect resources beyond the vulnerable component, potentially impacting the confidentiality, integrity, and availability of the WordPress installation.

Detection Methods for CVE-2026-24526

Indicators of Compromise

• Unusual JavaScript execution patterns in browser developer console logs related to the WooCommerce email inquiry functionality
• Suspicious URL parameters containing encoded script tags or JavaScript event handlers targeting the plugin's endpoints
• User reports of unexpected redirects or pop-ups when interacting with email inquiry or cart options features
• Web application firewall logs showing blocked XSS patterns in requests to WooCommerce plugin endpoints

Detection Strategies

• Implement Content Security Policy (CSP) headers with strict script-src directives to detect and block inline script execution
• Deploy web application firewall (WAF) rules to identify common XSS payloads in URL parameters and form submissions
• Monitor browser console errors and JavaScript exceptions that may indicate attempted exploitation
• Review server access logs for requests containing suspicious patterns like <script>, javascript:, or encoded variants targeting plugin URLs

Monitoring Recommendations

• Enable detailed logging for the WooCommerce plugin ecosystem and review for anomalous activity
• Configure SentinelOne Singularity to monitor for suspicious JavaScript execution patterns and DOM manipulation
• Set up alerts for CSP violation reports that may indicate XSS exploitation attempts
• Regularly audit plugin versions and compare against known vulnerable versions in security databases

How to Mitigate CVE-2026-24526

Immediate Actions Required

• Verify if your WordPress installation uses the Email Inquiry & Cart Options for WooCommerce plugin by checking the plugins directory
• If the plugin version is 3.4.3 or earlier, disable the plugin until a patched version is available
• Implement a Web Application Firewall (WAF) with XSS protection rules as a temporary mitigation
• Review user accounts for any suspicious activity that may indicate prior exploitation

Patch Information

At the time of this advisory, users should check the Patchstack vulnerability database for the latest patch information and updates from the plugin developer. Monitor the official WordPress plugin repository for version updates beyond 3.4.3 that address this vulnerability.

Workarounds

• Temporarily disable the Email Inquiry & Cart Options for WooCommerce plugin if email inquiry functionality is not critical
• Implement strict Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Restrict plugin access to trusted administrators only and limit the number of low-privilege authenticated users
• Consider using alternative WooCommerce plugins that provide similar functionality with verified security practices

# WordPress CLI command to check plugin version
wp plugin list --name=woocommerce-email-inquiry-cart-options --fields=name,version,status

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate woocommerce-email-inquiry-cart-options

# Add CSP header via .htaccess (Apache) as temporary mitigation
# Add to your .htaccess file:
# Header set Content-Security-Policy "script-src 'self'; object-src 'none';"