Stored Cross-Site Scripting in WooCommerce Plugin by WordPress

CVE-2026-1381

What is CVE-2026-1381?

The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress has a vulnerability that allows authenticated attackers with Shop Manager permissions or higher to conduct stored cross-site scripting (XSS) attacks. This vulnerability arises from inadequate input sanitization and output escaping, enabling attackers to inject arbitrary web scripts into plugin settings. The issue is primarily present in multi-site installations and when unfiltered_html is disabled. When a user accesses the affected pages, these scripts will execute, posing a significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References