CVE-2026-57396: Free Gifts for WooCommerce XSS Flaw

CVE-2026-57396 Overview

CVE-2026-57396 is a stored cross-site scripting (XSS) vulnerability in the Flintop Free Gifts for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 13.1.0. Attackers can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The vulnerability is tracked under [CWE-79] and requires user interaction to trigger, but it does not require authentication. Successful exploitation crosses a security scope boundary, impacting confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact

An unauthenticated attacker can plant persistent JavaScript in the WooCommerce storefront, hijacking sessions and pivoting to administrator accounts when staff view the poisoned pages.

Affected Products

• Flintop Free Gifts for WooCommerce plugin (free-gifts-for-woocommerce)
• All versions from n/a through <= 13.1.0
• WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

• 2026-07-13 - CVE-2026-57396 published to NVD
• 2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57396

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input during web page generation. The plugin accepts input that is later rendered into HTML output without adequate encoding or sanitization. This allows an attacker to store a malicious script payload that executes when another user loads the affected page.

Because the payload is stored server-side, every visitor who renders the impacted view triggers the script. The scope change indicated by the CVSS vector shows the payload can affect resources beyond the vulnerable component, such as the WordPress admin session context. Exploitation requires a victim to interact with the affected page, typically by browsing the storefront or reviewing plugin data in wp-admin.

Root Cause

The root cause is missing or insufficient output encoding on data paths that render user-controlled input. WordPress provides context-aware escaping helpers such as esc_html(), esc_attr(), and wp_kses_post(), but the plugin fails to apply them consistently before echoing input into the HTML response. Input sanitization at the storage layer via sanitize_text_field() is also absent or incomplete.

Attack Vector

The attack is delivered over the network and requires no authentication. An attacker submits a crafted payload through a plugin input surface exposed to unauthenticated users. When a shop administrator or customer subsequently loads the affected view, the browser parses the stored payload as executable script. The attacker can steal session cookies, perform actions on behalf of the victim, deface the storefront, or redirect shoppers to malicious infrastructure.

See the Patchstack WordPress Plugin Advisory for further technical context.

Detection Methods for CVE-2026-57396

Indicators of Compromise

• Unexpected <script>, onerror=, or onload= fragments stored in WooCommerce product, gift-rule, or plugin option records within the wp_options and wp_postmeta tables.
• Outbound browser requests from shop administrators to unfamiliar domains immediately after loading plugin admin pages.
• New or modified WordPress administrator accounts created shortly after a staff member visited a plugin-managed page.

Detection Strategies

• Audit database rows written by the free-gifts-for-woocommerce plugin for HTML tags, JavaScript event handlers, or encoded script payloads.
• Deploy a web application firewall rule that inspects requests to plugin endpoints for XSS signatures such as <script, javascript:, and onerror=.
• Enable a strict Content Security Policy in report-only mode and review violation reports for inline script execution originating from plugin views.

Monitoring Recommendations

• Log all POST requests to /wp-admin/admin-ajax.php and plugin-specific endpoints, and alert on payloads containing HTML control characters.
• Monitor WordPress audit logs for unexpected changes to gift rules, product meta, or plugin settings by unauthenticated sessions.
• Track administrator session activity for anomalous API calls that follow admin-panel page loads.

How to Mitigate CVE-2026-57396

Immediate Actions Required

• Identify all WordPress sites running the free-gifts-for-woocommerce plugin at version 13.1.0 or earlier and prioritize remediation.
• Deactivate the plugin until a patched release is applied if the site cannot be updated immediately.
• Rotate WordPress administrator passwords and invalidate active sessions if suspicious stored content is discovered.

Patch Information

At the time of publication, no fixed version is listed in the Patchstack advisory beyond the affected range of <= 13.1.0. Site owners should monitor the Patchstack WordPress Plugin Advisory and the vendor's WordPress.org plugin page for a security release and apply it immediately once available.

Workarounds

• Restrict access to WooCommerce admin pages by IP allowlist while the plugin remains unpatched.
• Deploy a virtual patch through a WordPress-aware WAF (for example, Patchstack, Wordfence, or ModSecurity CRS) to block XSS payloads targeting plugin endpoints.
• Enforce a Content Security Policy that disallows inline scripts and untrusted script sources to reduce payload execution impact.
• Remove any stored plugin data that contains HTML or JavaScript introduced by untrusted users before returning the plugin to production use.

# Example: temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate free-gifts-for-woocommerce

# Verify no residual references remain in active options
wp option list --search='*free_gifts*'