CVE-2026-13725

HighCVSS 7.1

Published: 01/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before version 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) against a victim who is induced to send a crafted request.

Risk Assessment

Risk of malicious script execution in the victim's browser, potentially leading to session theft, redirects, or other attacks.

Recommendation

Update the Dynamic Pricing With Discount Rules for WooCommerce plugin to version 5.0.0 or later.

Other vulnerabilities in Dynamic Pricing With Discount Rules for WooCommerce

CVE-2026-59556High
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Dynamic Pricing With Discount Rules for WooCommerce plugin up to version 4.5.11. Allows an attacker to inject malicious scripts.

Original NVD description (English source)

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.