WordPress security by component
StoreGrowth
StoreGrowth (storegrowth-sales-booster) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 06, 2026; the highest published CVSS base score is 7.5.
Plugin slug:
storegrowth-sales-boosterLatest vulnerability
CVE-2026-39750: StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart: cross-site scripting
No attacker login is required. Attacker-controlled content is rendered in browser output without sufficient neutralization, allowing script execution under the site's origin when a victim encounters the affected output. The endpoint, field, rendering function and victim role are undisclosed. The export does not distinguish stored from reflected XSS. The supplied vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Victim interaction is required by the vector. Affected versions: <= 2.0.6. The authoritative export identifies 2.1.1 as fixed for this CVE.
| Safe version |
|
||
|---|---|---|---|
| Oct 06, 2026 |
CVE-2026-39750
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart: cross-site scripting
No attacker login is required. Attacker-controlled content is rendered in browser output without sufficient neutralization, allowing script execution under the site's origin when a victim encounters the affected output. The endpoint, field, rendering function and victim role are undisclosed. The export does not distinguish stored from reflected XSS. The supplied vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Victim interaction is required by the vector. Affected versions: <= 2.0.6. The authoritative export identifies 2.1.1 as fixed for this CVE.
|
2.1.1 |
CVE7.1
|
| Aug 13, 2026 |
CVE-2026-66466
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart: Broken access control
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.1.1.
|
See mitigation notes |
CVE7.5
|
| Jul 28, 2026 |
CVE-2026-15411
StoreGrowth permits unauthenticated overwrite of sales-popup configuration
StoreGrowth through 2.1.0 registers create_popup for both authenticated and unauthenticated admin-ajax requests. create_popup() checks only the ajd_protected nonce, while front_scripts() publishes that nonce to every front-end visitor as bogo_save_url.ajd_nonce. An unauthenticated attacker can submit attacker-controlled JSON in data; popup_data reaches update_option('spsg_popup_products', ...), overwriting the saved sales-popup configuration. StoreGrowth 2.1.1 removes the unauthenticated hook and requires an admin nonce plus manage_options.
|
2.1.1 |
CVE5.3
|
| Jul 28, 2026 |
CVE-2026-13440
StoreGrowth allows unauthenticated stored script injection
StoreGrowth through 2.1.0 registers the create_popup AJAX action for logged-out visitors. Its only access check uses the ajd_protected nonce, but that same nonce is disclosed to every storefront visitor as bogo_save_url.ajd_nonce. An unauthenticated attacker can submit data[popup_data][message_popup] to create_popup(), which stores the unsanitized value in spsg_popup_products; storefront JavaScript later inserts message_popup with .html(), executing attacker-supplied script for visitors. Version 2.1.1 removes logged-out access, requires manage_options and a separate admin nonce, and sanitizes popup data on save and render.
|
2.1.1 |
CVE7.2
|
| Jul 28, 2026 |
CVE-2026-13110
StoreGrowth permits unauthenticated changes to BOGO category messages
StoreGrowth through 2.1.0 registers bogo_category_msg_create as both wp_ajax_ and wp_ajax_nopriv_. The handler checks only the public ajd_protected nonce, accepts attacker-controlled data[id], data[message], data[categoryStatus] and optional data[editableId], and writes the result to spsg_bogo_general_settings with update_option(). An unauthenticated attacker can therefore create or modify BOGO category-message configuration. Version 2.1.1 removes the unauthenticated hook and adds an admin nonce and manage_options check.
|
2.1.1 |
CVE5.3
|