CVE-2026-13440: Stored Cross-Site Scripting in StoreGrowth WooCommerce Plugin

CVE-2026-13440 details a Stored Cross-Site Scripting (XSS) vulnerability affecting the StoreGrowth: Smart Sales Booster for WooCommerce plugin for WordPress, specifically in all versions up to and including 2.1.0. This flaw originates from inadequate input sanitization and output escaping of the message_popup parameter. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts are then executed in a victim's browser whenever they access an injected page, potentially leading to session hijacking, website defacement, or redirection to malicious sites. A critical aspect of the exploit is the exposure of the ajd_protected nonce, which is required by the create_popup handler, to all unauthenticated frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce. This exposure effectively bypasses the nonce-based access control, making the vulnerability easily exploitable without authentication.

Attack Chain

1. Vulnerability Identification: An unauthenticated attacker identifies a WordPress site running the vulnerable StoreGrowth WooCommerce plugin (version <= 2.1.0).
2. Nonce Discovery: The attacker inspects the client-side JavaScript on the WordPress site and discovers the ajd_protected nonce exposed via wp_localize_script under bogo_save_url.ajd_nonce.
3. Payload Crafting: The attacker develops a malicious JavaScript payload (e.g., for session hijacking, defacement, or redirection) to inject into the message_popup parameter.
4. Malicious Request: The attacker sends an HTTP POST request to the plugin's AJAX handler (e.g., wp-admin/admin-ajax.php) with the appropriate action for the create_popup handler, including the retrieved ajd_protected nonce and the malicious script embedded in the message_popup parameter.
5. Payload Storage: Due to insufficient input sanitization and output escaping, the plugin processes the request and stores the malicious JavaScript payload persistently within the website's database.
6. Victim Interaction: A legitimate user (e.g., site administrator, customer) browses to a page on the affected WordPress site where the plugin is configured to display the stored popup message.
7. Script Execution: The user's web browser renders the page, retrieves the stored malicious JavaScript, and executes it within the context of the vulnerable website.
8. Impact: The executed script performs actions such as stealing session cookies, defacing the webpage, redirecting the user to attacker-controlled sites, or initiating further client-side attacks, leading to compromise of the user's account or system.

Impact

This Stored Cross-Site Scripting vulnerability (CVE-2026-13440) allows unauthenticated attackers to execute arbitrary web scripts in the browsers of legitimate users visiting an affected WordPress site. The successful exploitation can lead to significant consequences, including but not limited to, session hijacking, which grants attackers unauthorized access to user accounts (including administrative accounts), website defacement, sensitive data theft via client-side exfiltration, or redirection of users to phishing pages or sites hosting malware. Any user accessing a page where the malicious script is rendered by the vulnerable plugin is at risk. There is no information available regarding the number of victims or specific sectors targeted at this time, but all WordPress sites using the StoreGrowth WooCommerce plugin up to version 2.1.0 are potentially vulnerable.

Recommendation

• Patch CVE-2026-13440 immediately by updating the "StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin" to a patched version beyond 2.1.0.
• Review web server access logs for requests related to the create_popup handler on wp-admin/admin-ajax.php that contain suspicious script content in the message_popup parameter.
• Implement a Web Application Firewall (WAF) to detect and block malicious requests attempting to exploit XSS vulnerabilities, specifically looking for script tags or event handlers in input parameters to WordPress AJAX endpoints.