Stored Cross-Site Scripting Vulnerability in European VAT Compliance Assistant for WooCommerce Plugin

CVE-2026-100316

What is CVE-2026-100316?

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the CF-IPCountry Header. This issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts can be executed on pages accessed by users, as the malicious header value is retained in the order post-meta during guest checkouts, eliminating the need for user accounts or authentication to deploy the payload. Such vulnerabilities can lead to a range of threats, including data theft and unauthorized actions on behalf of legitimate users.

References