CVE-2026-6447

The Call for Price for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/woocommerce-call-for-price/tags/4.2.0/includes/admin/class-wc-call-for-price-settings-product-types.php#L68
• https://plugins.trac.wordpress.org/browser/woocommerce-call-for-price/tags/4.2.0/includes/class-wc-call-for-price.php#L681
• https://plugins.trac.wordpress.org/browser/woocommerce-call-for-price/trunk/includes/admin/class-wc-call-for-price-settings-product-types.php#L68
• https://plugins.trac.wordpress.org/browser/woocommerce-call-for-price/trunk/includes/class-wc-call-for-price.php#L681
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3513448%40woocommerce-call-for-price&new=3513448%40woocommerce-call-for-price&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7bffb16d-38dc-49b8-96bd-c13923069d9c?source=cve

Published

May 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64464In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64465In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64466In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64467In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-64468In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64469In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64470In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64471In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64472In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64473In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64474In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64475In the Linux kernel, the following vulnerability has been re…8.8