WordPress security by component
Dynamic Pricing With Discount Rules for WooCommerce
Plugin description
Dynamic Pricing With Discount Rules for WooCommerce is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest published CVSS base score is 9.1.
Plugin slug:
aco-woo-dynamic-pricingLatest vulnerability
CVE-2026-59556: Dynamic Pricing public input permits cross-site scripting
Dynamic Pricing With Discount Rules for WooCommerce through 4.5.11 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the store's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-59556
Dynamic Pricing public input permits cross-site scripting
Dynamic Pricing With Discount Rules for WooCommerce through 4.5.11 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the store's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
|
5.0.0 |
CVE7.1
NVDPending
|
| Nov 06, 2025 |
CVE-2025-47588
Dynamic Pricing With Discount Rules for WooCommerce: Code execution
Dynamic Pricing With Discount Rules for WooCommerce is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE9.1
NVDPending
|