Unauthenticated Stored Cross-Site Scripting in SUMO Reward Points for WordPress
CVE-2026-7534

7.2HIGH

Key Information:

Vendor

WordPress
Status
Sumo Reward Points For WooCommerce
Vendor
CVE Published:
23 July 2026

What is CVE-2026-7534?

The SUMO Reward Points plugin for WordPress allows unauthenticated users to exploit a stored Cross-Site Scripting vulnerability via the REST API endpoint /wp-json/wc-srp/v1/earning. This vulnerability arises from the improper handling of user capabilities, allowing any user — including those unauthenticated — to access sensitive functionalities. The absence of proper sanitization for the reason parameter within the create_items() function and lack of output escaping in the column_default() method of SRP_Master_Log enable attackers to inject malicious scripts into the reward points log. These scripts execute whenever an administrator views the Master Log or User Reward Points pages, posing a significant risk to site security.

Affected Version(s)

SUMO Reward Points for WooCommerce 0 <= 32.7.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/sumo-reward-points-woocommerc...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Cong Quang
.