CVE-2026-13440Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message_popup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because the 'ajd_protected' nonce required by the create_popup handler is exposed to all unauthenticated frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce, effectively bypassing the nonce-only access control.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-13440/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters91d
Disclosure
CVE-2026-13440 - Stored XSS in StoreGrowth WooCommerce. Unauthenticated inject scripts via message_popup. CVSS 7.2. No patch. Remove plugin until update. #CVE #WordPress #infosec #devsecops #developers #sysadmin #git #github #gitlab #Developer #DevelopingUgandaTogether #docker #linux https://www.valtersit.com/cve/CVE-2026-13440/
Post summary
The post announces a new Stored XSS vulnerability (CVE‑2026‑13440) in StoreGrowth WooCommerce, provides technical details and a CVSS score, notes no patch is available, and advises removing the plugin until an update arrives.
0001082
977 followersView on X

Explore more

Back to dashboard