CVE-2026-39750

HighCVSS 7.1

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

A vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce plugin up to version 2.0.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).

Risk Assessment

An unauthenticated attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or other attacks.

Recommendation

Update the StoreGrowth plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in StoreGrowth: Smart Sales Booster for WooCommerce

CVE-2026-66466High
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce plugin versions up to 2.1.1. An attacker without authentication can access unauthorized functions.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS