CVE-2026-103899

The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.

• CWE-79

• https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/integration/admin/orders_integration.php#L238
• https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/integration/vat_number_validation/validators/vat_number_validator.php#L132
• https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/order/order.php#L56
• https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/plugin-main.php#L1655
• https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/plugin-main.php#L901
• https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/views/admin/order-vat-info-box.php#L173
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cd7c07-e119-4064-a7a9-08c81409f90a?source=cve

Published

Oct 17, 2026

Last Modified

Oct 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103885Asymmetric Resource Consumption vulnerability in Apache Dire…7.5
• CVE-2026-103888The WPC Smart Quick View for WooCommerce plugin for WordPres…6.1
• CVE-2026-103889The 3D Product configurator for WooCommerce plugin for WordP…9.8
• CVE-2026-103895The miniOrange OTP Login, Verification and SMS Notifications…8.1
• CVE-2026-103896The 10Web Booster – Website speed optimization, Cache & Page…7.5
• CVE-2026-103897The Responsive Lightbox & Gallery plugin for WordPress is vu…4.4
• CVE-2026-103902Improper verification of cryptographic signature vulnerabili…7.5
• CVE-2026-103903An incorrect authorization vulnerability in the WinBox authe…8.8
• CVE-2026-103904The public consent endpoint of JTL-Shop accepts arbitrary co…9.3
• CVE-2026-103905The authentication middleware of the JTL-Shop administration…7.5
• CVE-2026-103907The JNews - Jeg Elementor Kit plugin for WordPress is vulner…6.5
• CVE-2026-103909The Calculated Fields Form – AI Form Builder for WordPress –…6.1