CVE-2026-7613: WordPress Cost of Goods Plugin XSS Flaw

CVE-2026-7613 Overview

CVE-2026-7613 is a Stored Cross-Site Scripting (XSS) vulnerability in the Cost of Goods by PixelYourSite plugin for WordPress. The flaw affects all versions up to and including 1.2.12. The vulnerability resides in the csvdata[0][cost_of_goods_value] parameter, which lacks adequate input sanitization and output escaping. Unauthenticated attackers can inject arbitrary JavaScript into stored content. The injected scripts execute in the browser of any user who accesses an affected page. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Unauthenticated attackers can inject persistent JavaScript that runs in administrator and visitor browsers, enabling session theft, content manipulation, and further compromise of the WordPress site.

Affected Products

• Cost of Goods by PixelYourSite plugin for WordPress
• All versions up to and including 1.2.12
• WordPress sites using the affected plugin for WooCommerce cost tracking

Discovery Timeline

• 2026-05-20 - CVE-2026-7613 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-7613

Vulnerability Analysis

The vulnerability is a Stored XSS flaw in the Cost of Goods by PixelYourSite plugin. The plugin accepts CSV-formatted input through the csvdata[0][cost_of_goods_value] parameter without enforcing strict input validation. Submitted values are stored in the WordPress database and later rendered into pages without proper output escaping. Any HTML or JavaScript supplied through this parameter is persisted and executed in the context of the WordPress site.

Because the vulnerable endpoint does not require authentication, attackers can deliver payloads without valid credentials. Stored XSS is particularly impactful because the payload executes for every user who loads the affected page, including authenticated administrators.

Root Cause

The root cause is twofold: insufficient input sanitization at the point where CSV data is parsed and accepted, and inadequate output escaping when the stored value is rendered into HTML. Neither WordPress sanitization functions such as sanitize_text_field() nor escaping functions such as esc_html() or esc_attr() are applied effectively to the cost_of_goods_value field.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond visiting a page containing the injected script. An attacker submits crafted CSV data containing a JavaScript payload through the vulnerable parameter. The payload persists in the database. When any user, including site administrators, browses an affected page, the script executes in their browser session. This can lead to session hijacking, credential theft via fake login overlays, administrative action forgery, or redirection to attacker-controlled infrastructure.

No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-7613

Indicators of Compromise

• Unexpected <script>, onerror, onload, or javascript: strings stored within plugin-related database tables, particularly fields tied to cost_of_goods_value.
• HTTP POST requests to plugin endpoints containing the csvdata[0][cost_of_goods_value] parameter with HTML or JavaScript content.
• Outbound browser requests from administrator sessions to unknown external domains following access to product or cost pages.

Detection Strategies

• Inspect web server access logs for unauthenticated POST requests targeting the plugin's CSV import functionality.
• Query the WordPress database for plugin options and post meta entries containing script tags or event handler attributes.
• Deploy a Web Application Firewall (WAF) rule that blocks payloads containing HTML or JavaScript syntax in the affected parameter.

Monitoring Recommendations

• Monitor administrator account activity for unexpected privilege changes, new user creation, or plugin installations.
• Alert on Content Security Policy (CSP) violations originating from WordPress admin and front-end pages.
• Track integrity of plugin files and database options associated with the Cost of Goods by PixelYourSite plugin.

How to Mitigate CVE-2026-7613

Immediate Actions Required

• Update the Cost of Goods by PixelYourSite plugin to a version newer than 1.2.12 once a patched release is published by the vendor.
• If no patched version is available, deactivate and remove the plugin from affected WordPress installations.
• Audit existing plugin data and CSV import history for stored payloads, and purge any malicious entries.
• Rotate administrator credentials and invalidate active sessions if compromise is suspected.

Patch Information

Review the vendor product page at PixelYourSite WooCommerce Plugin for the latest release information. The Wordfence Vulnerability Analysis tracks remediation status for this CVE.

Workarounds

• Restrict access to WordPress admin and plugin endpoints using IP allowlists at the web server or WAF layer.
• Deploy a strict Content Security Policy that disallows inline scripts and untrusted external sources.
• Apply WAF rules that block HTML tags and JavaScript event handlers submitted to the csvdata[0][cost_of_goods_value] parameter.

# Example WAF rule (ModSecurity) to block script payloads in the vulnerable parameter
SecRule ARGS:'csvdata[0][cost_of_goods_value]' "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026713,phase:2,deny,status:403,log,msg:'Blocked XSS payload targeting CVE-2026-7613'"