{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/the-eu-vat-assistant-for-woocommerce--2.1.30.260413/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wordpress:the_eu_vat_assistant_for_woocommerce:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-103899"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["The EU VAT Assistant for WooCommerce (\u003c= 2.1.30.260413)"],"_cs_severities":["medium"],"_cs_tags":["xss","wordpress","web-vulnerability","cve-2026-103899"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe EU VAT Assistant for WooCommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-103899. This flaw exists due to inadequate input sanitization and output escaping within the 'vat_number' parameter. The vulnerability allows an unauthenticated remote attacker to inject malicious JavaScript into the application. When a site administrator accesses the WooCommerce orders management interface to review an affected order, the stored payload executes within their browser context. This execution can be leveraged to perform unauthorized actions on behalf of the administrator, such as creating new rogue administrative accounts, thereby achieving full site takeover. All versions of the plugin up to and including 2.1.30.260413 are impacted.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a publicly accessible order placement or profile update page that utilizes the vulnerable EU VAT Assistant plugin.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious JavaScript payload designed to perform unauthorized administrative actions, such as 'wp-admin/user-new.php' requests.\u003c/li\u003e\n\u003cli\u003eThe attacker submits the order or profile information, injecting the JavaScript payload into the 'vat_number' parameter.\u003c/li\u003e\n\u003cli\u003eThe application fails to sanitize or escape the input, storing the malicious script directly into the WordPress database.\u003c/li\u003e\n\u003cli\u003eA legitimate administrator navigates to the WooCommerce Orders section to review the transaction.\u003c/li\u003e\n\u003cli\u003eThe browser renders the stored script while the administrator views the 'Edit Order' screen.\u003c/li\u003e\n\u003cli\u003eThe script executes with the administrator's session privileges, allowing the attacker to create a new administrative user or modify system settings.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates as the newly created administrative user to gain persistent access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's session. This leads to full site compromise, including the ability to exfiltrate sensitive data, inject unauthorized content, or create persistent administrative backdoors. Given the ubiquity of WooCommerce installations, the potential victim base is significant.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate The EU VAT Assistant for WooCommerce plugin to the latest version immediately following vendor guidance.\u003c/li\u003e\n\u003cli\u003eReview WordPress audit logs for unexpected administrative account creation or changes to user roles.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources on the administrative dashboard.\u003c/li\u003e\n\u003cli\u003eAudit administrative access to the WooCommerce backend, specifically monitoring for unusual 'wp-admin' traffic originating from external sources or suspicious browser agents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T04:48:20Z","date_published":"2026-10-17T04:48:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vat-assistant-xss/","summary":"An unauthenticated Stored Cross-Site Scripting vulnerability in The EU VAT Assistant for WooCommerce plugin (\u003c= 2.1.30.260413) allows attackers to inject malicious scripts that execute in the administrator's context, potentially leading to account takeover.","title":"Stored XSS in The EU VAT Assistant for WooCommerce Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-vat-assistant-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - The EU VAT Assistant for WooCommerce (\u003c= 2.1.30.260413)","version":"https://jsonfeed.org/version/1.1"}