CVE-2026-6447 Overview
CVE-2026-6447 is a Stored Cross-Site Scripting (XSS) vulnerability in the Call for Price for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 4.2.0. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts into pages. Injected scripts execute whenever a user accesses the affected page. The issue is classified under CWE-79 and tracks as a Stored XSS weakness.
Critical Impact
Exploitation requires administrator-level access and only affects multi-site installations or environments where unfiltered_html has been disabled, limiting the practical attack surface.
Affected Products
- Call for Price for WooCommerce plugin for WordPress — all versions through 4.2.0
- WordPress multi-site installations running the affected plugin
- WordPress installations where the unfiltered_html capability has been disabled
Discovery Timeline
- 2026-05-02 - CVE-2026-6447 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-6447
Vulnerability Analysis
The Call for Price for WooCommerce plugin processes administrator-supplied data from its settings interface without enforcing proper sanitization on input or escaping on output. As a result, script payloads stored in plugin settings are rendered directly within HTML contexts where they execute as part of the page. The affected logic resides in includes/admin/class-wc-call-for-price-settings-product-types.php near line 68 and includes/class-wc-call-for-price.php near line 681, as referenced in the WordPress Plugin Code Snippet. The vulnerability is constrained by WordPress capability rules. By default, administrators on single-site installations possess the unfiltered_html capability, which legitimately allows raw HTML and JavaScript in posts and settings. The CVE therefore applies only to multi-site networks, where unfiltered_html is restricted to super administrators, and to single-site environments where administrators have had the capability stripped.
Root Cause
The root cause is missing escaping of stored configuration values when they are rendered into admin and front-end pages. The plugin trusts administrator input rather than applying functions such as esc_html(), esc_attr(), or wp_kses() at output time.
Attack Vector
An authenticated attacker holding administrator privileges submits a malicious JavaScript payload through the plugin's settings form. The payload is persisted to the WordPress options table. When any user — including higher-privileged super administrators — loads a page that renders the stored value, the script executes in their browser session. This permits session theft, forced administrative actions, and pivoting toward the super administrator role on multi-site networks.
No verified exploitation code is publicly available for this issue. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-6447
Indicators of Compromise
- Unexpected <script> tags, event handlers, or javascript: URIs stored in WordPress wp_options rows associated with the woocommerce-call-for-price plugin.
- Outbound browser requests from administrator sessions to unrecognized domains shortly after loading WooCommerce settings pages.
- New or modified administrator or super administrator accounts created shortly after settings page access.
Detection Strategies
- Audit wp_options and plugin-specific configuration entries for HTML or script content using database queries that match on <script, onerror=, or onload= patterns.
- Review WordPress activity logs for settings updates submitted to Call for Price admin endpoints by accounts that do not normally manage WooCommerce.
- Compare installed plugin versions across the estate against 4.2.0 and earlier to identify exposed sites.
Monitoring Recommendations
- Enable WordPress audit logging on plugin settings changes and ship logs to a centralized SIEM for correlation.
- Monitor administrator session activity for anomalous CSRF-style POSTs to admin.php?page=wc-settings immediately followed by user creation or role changes.
- Alert on changes to the unfiltered_html capability assignment and on any new super administrator promotion in multi-site networks.
How to Mitigate CVE-2026-6447
Immediate Actions Required
- Update the Call for Price for WooCommerce plugin to a version released after 4.2.0 that addresses the sanitization defect.
- Inventory all multi-site networks and hardened single-site installations to confirm whether the vulnerable plugin is present.
- Review plugin settings for any previously stored script content and remove malicious values from the database.
Patch Information
The vendor committed remediation in changeset 3513448 to the plugin repository, documented in the WordPress Plugin Change History. Administrators should apply the latest available release through the WordPress plugin updater.
Workarounds
- Restrict administrator account assignment on multi-site networks and require multi-factor authentication for all privileged WordPress accounts.
- Deploy a Web Application Firewall rule that blocks HTML and JavaScript payloads submitted to the plugin's settings endpoints until patching is complete.
- Temporarily deactivate the Call for Price for WooCommerce plugin on affected installations where an immediate update is not possible.
# Configuration example: identify vulnerable installations via WP-CLI
wp plugin get woocommerce-call-for-price --field=version
wp plugin update woocommerce-call-for-price
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
