Stored Cross-Site Scripting in Cost of Goods: Product Cost & Profit Calculator for WooCommerce Plugin

CVE-2026-6962

What is CVE-2026-6962?

The Cost of Goods: Product Cost & Profit Calculator plugin for WooCommerce is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on specific shortcodes. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts into pages. When other users access these compromised pages, the scripts can execute, potentially leading to unauthorized actions or data theft. Proper security measures should be implemented to mitigate the risks associated with this vulnerability.

References