Stored Cross-Site Scripting in WowStore Plugin for WooCommerce

CVE-2026-17161

What is CVE-2026-17161?

The WowStore – Store Builder & Product Blocks plugin for WooCommerce is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability exists in all versions up to and including 4.4.24, allowing authenticated attackers with contributor-level access or higher to inject malicious scripts. The issue arises from the preservation of payloads stored within a Gutenberg block delimiter comment as JSON, leading to a failure in proper sanitization when rendered. Affected users may unknowingly execute attacker-injected scripts when accessing compromised pages.

References