Stored Cross-Site Scripting Vulnerability in FlexStock for WooCommerce
CVE-2026-107711

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Flexstock – Product Stock Sync With Google Sheets For WooCommerce
Vendor
CVE Published:
31 October 2026

What is CVE-2026-107711?

The FlexStock plugin for WooCommerce is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping in the 'products[].post_content' parameter. This vulnerability enables authenticated attackers, with subscriber-level access and higher, to inject and execute arbitrary web scripts on user-accessed pages. The exploitable flaw lies in exposure of the REST bearer token within the Dashboard page source, allowing unauthorized script injection when users interact with compromised pages.

Affected Version(s)

FlexStock – Product Stock Sync with Google Sheets for WooCommerce 0 <= 3.17.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/stock-sync-wit...
https://plugins.trac.wordpress.org/browser/stock-sync-wit...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Morato Antoine
.