Skip to content
Threat Feed
Subscribe

Vendor

SUMO

1 brief RSS
high advisory

SUMO Reward Points WordPress Plugin Vulnerable to Unauthenticated Stored XSS via REST API (CVE-2026-7534)

The SUMO Reward Points plugin for WordPress, versions up to and including 32.7.0, is vulnerable to CVE-2026-7534, an Unauthenticated Stored Cross-Site Scripting flaw that allows attackers to inject arbitrary web scripts into the reward points log via the `/wp-json/wc-srp/v1/earning` REST API endpoint, executing when an administrator accesses specific admin pages.

SUMO Reward Points plugin < 32.7.0 +1 wordpress xss web-vulnerability plugin stored-xss
1r 2t 1c