CVE-2026-13725CWE-79cross-site-scripting

CVE-2026-13725

High · published August 1, 2026

CVSS v3.1

7.1

EPSS

Percentile

19.6

In the wild

Unconfirmed

What it is

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00282 · 19.6th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-08-01T11:16Z

References (1)

https://wpscan.com/vulnerability/5e3786de-4b4d-4da2-b129-7b0fef90a386/ · [email protected]

EPSS history

Timeline

01 AUG 06:00Z
Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax
cvelistv5