CVE-2026-107711

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber-level user because the plugin's admin_enqueue_scripts callback exposes the REST bearer token in the Dashboard page source via wp_localize_script() without a capability check, and the REST endpoint's permission_callback validates only that bearer token rather than performing a current_user_can() capability check.

• CWE-79

• https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-api.php#L577
• https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-api.php#L79
• https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-app.php#L458
• https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/classes/class-hooks.php#L1184
• https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/helper/functions.php#L139
• https://plugins.trac.wordpress.org/browser/stock-sync-with-google-sheet-for-woocommerce/tags/3.17.2/includes/models/class-product.php#L1500
• https://plugins.trac.wordpress.org/changeset/3768111/stock-sync-with-google-sheet-for-woocommerce/trunk/includes/models/class-product.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b03cabc6-1cbe-4aa2-8eae-cea30d01b811?source=cve

Published

Oct 31, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107706Dolibarr ERP CRM before 24.0.2 contains an incorrect authori…4.3
• CVE-2026-107707Intego Antivirus for Windows through 3.0.0.1 contains a link…7.8
• CVE-2026-107708MIT krb5 through 1.22.2 contains a NULL pointer dereference …4.9
• CVE-2026-107709A path traversal vulnerability exists in Bower decompress-zi…7.8
• CVE-2026-10771A vulnerability was found in crmeb crmeb_java 1.4. Affected …7.3
• CVE-2026-107710The Hustle – Email Marketing, Lead Generation, Optins, Popup…6.4
• CVE-2026-107712The WP Booking System – Booking Calendar plugin for WordPres…6.5
• CVE-2026-107714The Mechanize library is used for automating interaction wit…5.9
• CVE-2026-107715The Mechanize library is used for automating interaction wit…6.8
• CVE-2026-107716Banks generates meaningful LLM prompts using a simple templa…7.3
• CVE-2026-107717Banks generates meaningful LLM prompts using a simple templa…6.5
• CVE-2026-107718AdonisJS HTTP Server is a package for handling HTTP requests…6.1