CVE-2026-39508
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Advanced Coupons for WooCommerce Coupons plugin for WordPress up to version 4.7.1.1 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.
Risk Assessment
An attacker can hijack user sessions, steal data, or inject malicious content, compromising data confidentiality and integrity.
Recommendation
Immediately update the Advanced Coupons for WooCommerce Coupons plugin to the latest available version that fixes this vulnerability.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows DOM-Based XSS.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.1.