European VAT Compliance Assistant for WooCommerce (<= 1.36.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/european-vat-compliance-assistant-for-woocommerce--1.36.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 17 Oct 2026 08:49:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in European VAT Compliance Assistant for WooCommercehttps://feed.craftedsignal.io/briefs/2026-10-european-vat-plugin-xss/Sat, 17 Oct 2026 08:49:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-european-vat-plugin-xss/The European VAT Compliance Assistant for WooCommerce plugin is vulnerable to unauthenticated stored cross-site scripting via the CF-IPCountry HTTP header.The European VAT Compliance Assistant for WooCommerce plugin for WordPress, in all versions up to and including 1.36.10, contains a stored cross-site scripting (XSS) vulnerability. The flaw stems from insufficient input sanitization and output escaping of the 'CF-IPCountry' HTTP header. Unauthenticated attackers can exploit this during the guest checkout process by injecting arbitrary web scripts into the header value. The plugin persists this malicious payload directly into the order post-meta. The injected script then executes whenever an administrative or privileged user views the compromised order data in the WordPress dashboard. Because the injection occurs during a standard guest checkout flow, it requires no authentication, allowing for unauthenticated exploitation to potentially achieve administrative session hijacking.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the WordPress administrative interface. This can lead to administrative session hijacking, unauthorized modification of site content, creation of rogue administrator accounts, or redirection of legitimate users to malicious sites. The vulnerability affects all sites running the vulnerable plugin version (<= 1.36.10) where Cloudflare or similar infrastructure might pass the 'CF-IPCountry' header.

Recommendation

  • Immediately update the 'European VAT Compliance Assistant for WooCommerce' plugin to the latest available version beyond 1.36.10.
  • Audit WordPress order metadata for suspicious script tags or obfuscated JavaScript patterns if the site logs indicate previous exploitation attempts via the 'CF-IPCountry' header.
  • Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS by restricting the execution of unauthorized scripts.
]]>highadvisory