Stored XSS in The EU VAT Assistant for WooCommerce Plugin

The EU VAT Assistant for WooCommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-103899. This flaw exists due to inadequate input sanitization and output escaping within the 'vat_number' parameter. The vulnerability allows an unauthenticated remote attacker to inject malicious JavaScript into the application. When a site administrator accesses the WooCommerce orders management interface to review an affected order, the stored payload executes within their browser context. This execution can be leveraged to perform unauthorized actions on behalf of the administrator, such as creating new rogue administrative accounts, thereby achieving full site takeover. All versions of the plugin up to and including 2.1.30.260413 are impacted.

Attack Chain

1. An attacker identifies a publicly accessible order placement or profile update page that utilizes the vulnerable EU VAT Assistant plugin.
2. The attacker crafts a malicious JavaScript payload designed to perform unauthorized administrative actions, such as 'wp-admin/user-new.php' requests.
3. The attacker submits the order or profile information, injecting the JavaScript payload into the 'vat_number' parameter.
4. The application fails to sanitize or escape the input, storing the malicious script directly into the WordPress database.
5. A legitimate administrator navigates to the WooCommerce Orders section to review the transaction.
6. The browser renders the stored script while the administrator views the 'Edit Order' screen.
7. The script executes with the administrator's session privileges, allowing the attacker to create a new administrative user or modify system settings.
8. The attacker authenticates as the newly created administrative user to gain persistent access.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's session. This leads to full site compromise, including the ability to exfiltrate sensitive data, inject unauthorized content, or create persistent administrative backdoors. Given the ubiquity of WooCommerce installations, the potential victim base is significant.

Recommendation

Prioritized actions for security teams:

• Update The EU VAT Assistant for WooCommerce plugin to the latest version immediately following vendor guidance.
• Review WordPress audit logs for unexpected administrative account creation or changes to user roles.
• Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources on the administrative dashboard.
• Audit administrative access to the WooCommerce backend, specifically monitoring for unusual 'wp-admin' traffic originating from external sources or suspicious browser agents.