Stored Cross-Site Scripting Vulnerability in WooCommerce Call for Price Plugin

CVE-2026-6447

What is CVE-2026-6447?

The Call for Price for WooCommerce plugin for WordPress is affected by a stored cross-site scripting vulnerability which occurs due to insufficient input sanitization and output escaping in the admin settings. This flaw permits authenticated users with administrator-level permissions to inject malicious web scripts. Such scripts could execute when an unsuspecting user visits an affected page, posing a significant risk, particularly in multi-site installations or where unfiltered_html has been disabled. It is crucial for administrators to update their installations promptly to mitigate this risk.

References