Reflected XSS Vulnerability in Dynamic Pricing With Discount Rules for WooCommerce by WordPress
CVE-2026-13725

Currently unrated

Key Information:

Vendor

WordPress
Status
Dynamic Pricing With Discount Rules For WooCommerce
Vendor
CVE Published:
1 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-13725?

The Dynamic Pricing With Discount Rules for WooCommerce plugin, prior to version 5.0.0, fails to validate nonces and user capabilities during certain AJAX requests. This weakness allows attackers to inject unsanitized input, potentially leading to reflected cross-site scripting (XSS) attacks. If a user is tricked into sending a maliciously crafted request, the attacker can manipulate the response, which may compromise the user's security and data integrity.

Affected Version(s)

Dynamic Pricing With Discount Rules for WooCommerce 0 < 5.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-13725 - Proof of Concept

References

https://wpscan.com/vulnerability/5e3786de-4b4d-4da2-b129-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Ramos Maciel
WPScan
.