{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/storegrowth/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-13440"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin (\u003c= 2.1.0)"],"_cs_severities":["high"],"_cs_tags":["xss","wordpress","web","impact","execution"],"_cs_type":"advisory","_cs_vendors":["StoreGrowth"],"content_html":"\u003cp\u003eCVE-2026-13440 details a Stored Cross-Site Scripting (XSS) vulnerability affecting the StoreGrowth: Smart Sales Booster for WooCommerce plugin for WordPress, specifically in all versions up to and including 2.1.0. This flaw originates from inadequate input sanitization and output escaping of the \u003ccode\u003emessage_popup\u003c/code\u003e parameter. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts are then executed in a victim's browser whenever they access an injected page, potentially leading to session hijacking, website defacement, or redirection to malicious sites. A critical aspect of the exploit is the exposure of the \u003ccode\u003eajd_protected\u003c/code\u003e nonce, which is required by the \u003ccode\u003ecreate_popup\u003c/code\u003e handler, to all unauthenticated frontend visitors via \u003ccode\u003ewp_localize_script\u003c/code\u003e under \u003ccode\u003ebogo_save_url.ajd_nonce\u003c/code\u003e. This exposure effectively bypasses the nonce-based access control, making the vulnerability easily exploitable without authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerability Identification\u003c/strong\u003e: An unauthenticated attacker identifies a WordPress site running the vulnerable StoreGrowth WooCommerce plugin (version \u0026lt;= 2.1.0).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eNonce Discovery\u003c/strong\u003e: The attacker inspects the client-side JavaScript on the WordPress site and discovers the \u003ccode\u003eajd_protected\u003c/code\u003e nonce exposed via \u003ccode\u003ewp_localize_script\u003c/code\u003e under \u003ccode\u003ebogo_save_url.ajd_nonce\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePayload Crafting\u003c/strong\u003e: The attacker develops a malicious JavaScript payload (e.g., for session hijacking, defacement, or redirection) to inject into the \u003ccode\u003emessage_popup\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Request\u003c/strong\u003e: The attacker sends an HTTP POST request to the plugin's AJAX handler (e.g., \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e) with the appropriate action for the \u003ccode\u003ecreate_popup\u003c/code\u003e handler, including the retrieved \u003ccode\u003eajd_protected\u003c/code\u003e nonce and the malicious script embedded in the \u003ccode\u003emessage_popup\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePayload Storage\u003c/strong\u003e: Due to insufficient input sanitization and output escaping, the plugin processes the request and stores the malicious JavaScript payload persistently within the website's database.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVictim Interaction\u003c/strong\u003e: A legitimate user (e.g., site administrator, customer) browses to a page on the affected WordPress site where the plugin is configured to display the stored popup message.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eScript Execution\u003c/strong\u003e: The user's web browser renders the page, retrieves the stored malicious JavaScript, and executes it within the context of the vulnerable website.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact\u003c/strong\u003e: The executed script performs actions such as stealing session cookies, defacing the webpage, redirecting the user to attacker-controlled sites, or initiating further client-side attacks, leading to compromise of the user's account or system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis Stored Cross-Site Scripting vulnerability (CVE-2026-13440) allows unauthenticated attackers to execute arbitrary web scripts in the browsers of legitimate users visiting an affected WordPress site. The successful exploitation can lead to significant consequences, including but not limited to, session hijacking, which grants attackers unauthorized access to user accounts (including administrative accounts), website defacement, sensitive data theft via client-side exfiltration, or redirection of users to phishing pages or sites hosting malware. Any user accessing a page where the malicious script is rendered by the vulnerable plugin is at risk. There is no information available regarding the number of victims or specific sectors targeted at this time, but all WordPress sites using the StoreGrowth WooCommerce plugin up to version 2.1.0 are potentially vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-13440 immediately by updating the \u0026quot;StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin\u0026quot; to a patched version beyond 2.1.0.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests related to the \u003ccode\u003ecreate_popup\u003c/code\u003e handler on \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e that contain suspicious script content in the \u003ccode\u003emessage_popup\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to detect and block malicious requests attempting to exploit XSS vulnerabilities, specifically looking for script tags or event handlers in input parameters to WordPress AJAX endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T12:18:30Z","date_published":"2026-07-28T12:18:30Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-13440-storegrowth-xss/","summary":"A high-severity Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-13440, exists in the StoreGrowth: Smart Sales Booster for WooCommerce WordPress plugin (versions up to and including 2.1.0) due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the 'message_popup' parameter that execute when a user accesses an affected page, facilitated by an exposed nonce.","title":"CVE-2026-13440: Stored Cross-Site Scripting in StoreGrowth WooCommerce Plugin","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-13440-storegrowth-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - StoreGrowth","version":"https://jsonfeed.org/version/1.1"}