WowStore – Store Builder & Product Blocks for WooCommerce
WowStore – Store Builder & Product Blocks for WooCommerce is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Jul 29, 2026; the highest CVE/CNA score is 8.7.
product-blocksCVE-2026-17162: WowStore Filter block permits contributor-level stored cross-site scripting
WowStore through 4.4.24 permits stored cross-site scripting through the currentPostId attribute of the product-blocks/filter block. An authenticated Contributor can save attacker-controlled currentPostId block data; WOPB\blocks\Filter::content() uses the value and then interpolates it without output escaping into the rendered data-postid attribute. The stored script executes when a user views the affected page, which can expose that user's session or allow actions in their browser. Version 4.5.0 converts currentPostId to an integer with absint() and escapes the rendered data-postid value with esc_attr().
| Safe version |
|
||
|---|---|---|---|
| Jul 29, 2026 |
CVE-2026-17162
WowStore Filter block permits contributor-level stored cross-site scripting
WowStore through 4.4.24 permits stored cross-site scripting through the currentPostId attribute of the product-blocks/filter block. An authenticated Contributor can save attacker-controlled currentPostId block data; WOPB\blocks\Filter::content() uses the value and then interpolates it without output escaping into the rendered data-postid attribute. The stored script executes when a user views the affected page, which can expose that user's session or allow actions in their browser. Version 4.5.0 converts currentPostId to an integer with absint() and escapes the rendered data-postid value with esc_attr().
|
4.5.0 |
CVE6.4
NVDPending
|
| Jul 29, 2026 |
CVE-2026-17161
WowStore mobile filter text permits contributor stored XSS
WowStore through 4.4.24 lets an authenticated Contributor place an attribute-breakout payload in the filterMobileText attribute of a Product Grid block. WordPress stores the block attributes as JSON inside a Gutenberg delimiter comment, which wp_kses_post preserves. The product-blocks/product-grid-1 server-side render_callback passes filterMobileText through blocks/template/filter.php to Functions::filter(), which concatenates it into the filter list's data-name HTML attribute without esc_attr(); the stored script can therefore execute whenever a visitor renders the affected page. No separate HTTP endpoint, action or request parameter is involved in the disclosed path.
|
4.5.0 |
CVE6.4
NVDPending
|
| Mar 17, 2026 |
CVE-2026-2579
WowStore – Store Builder & Product Blocks for WooCommerce: SQL injection
WowStore – Store Builder & Product Blocks for WooCommerce is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Apr 16, 2025 |
CVE-2025-39571
WowStore: A security weakness
WowStore is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jan 02, 2025 |
CVE-2023-45271
WowStore: A security weakness
WowStore is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Feb 12, 2024 |
CVE-2024-23512
ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: Code execution
ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.7
NVD9.8
|