Stored Cross-Site Scripting Vulnerability in Experto Dashboard for WooCommerce Plugin

CVE-2026-3574

What is CVE-2026-3574?

The Experto Dashboard for WooCommerce plugin for WordPress is susceptible to stored cross-site scripting attacks through its settings fields. Due to inadequate input sanitization and missing output escaping, authenticated users with Administrator-level access can inject malicious scripts into the plugin's settings. This vulnerability particularly affects multi-site installations and those with unfiltered_html disabled, leading to potential exposure whenever the settings page is accessed.

References