Stored Cross-Site Scripting in EU VAT Assistant for WooCommerce Plugin

CVE-2026-103899

What is CVE-2026-103899?

The EU VAT Assistant for WooCommerce plugin is susceptible to Stored Cross-Site Scripting through the 'vat_number' parameter. This vulnerability arises from inadequate input validation and output encoding, allowing unauthenticated attackers to inject malicious scripts. These scripts are executed within the context of an administrator's browser when they edit an order, leading to potential privilege escalation and the creation of unauthorized administrator accounts, endangering the entire WordPress site.

References