{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awp-vateuropean_vat_compliance_assistant_for_woocommercewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp-vat:european_vat_compliance_assistant_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-100316"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["European VAT Compliance Assistant for WooCommerce (\u003c= 1.36.10)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe European VAT Compliance Assistant for WooCommerce plugin for WordPress, in all versions up to and including 1.36.10, contains a stored cross-site scripting (XSS) vulnerability. The flaw stems from insufficient input sanitization and output escaping of the 'CF-IPCountry' HTTP header. Unauthenticated attackers can exploit this during the guest checkout process by injecting arbitrary web scripts into the header value. The plugin persists this malicious payload directly into the order post-meta. The injected script then executes whenever an administrative or privileged user views the compromised order data in the WordPress dashboard. Because the injection occurs during a standard guest checkout flow, it requires no authentication, allowing for unauthenticated exploitation to potentially achieve administrative session hijacking.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the WordPress administrative interface. This can lead to administrative session hijacking, unauthorized modification of site content, creation of rogue administrator accounts, or redirection of legitimate users to malicious sites. The vulnerability affects all sites running the vulnerable plugin version (\u0026lt;= 1.36.10) where Cloudflare or similar infrastructure might pass the 'CF-IPCountry' header.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the 'European VAT Compliance Assistant for WooCommerce' plugin to the latest available version beyond 1.36.10.\u003c/li\u003e\n\u003cli\u003eAudit WordPress order metadata for suspicious script tags or obfuscated JavaScript patterns if the site logs indicate previous exploitation attempts via the 'CF-IPCountry' header.\u003c/li\u003e\n\u003cli\u003eImplement strict Content Security Policy (CSP) headers to mitigate the impact of XSS by restricting the execution of unauthorized scripts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T08:49:11Z","date_published":"2026-10-17T08:49:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-european-vat-plugin-xss/","summary":"The European VAT Compliance Assistant for WooCommerce plugin is vulnerable to unauthenticated stored cross-site scripting via the CF-IPCountry HTTP header.","title":"Stored XSS in European VAT Compliance Assistant for WooCommerce","url":"https://feed.craftedsignal.io/briefs/2026-10-european-vat-plugin-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wp-Vat:european_vat_compliance_assistant_for_woocommerce:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}