CVE-2026-59556

HighCVSS 7.1

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Summary

Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Dynamic Pricing With Discount Rules for WooCommerce plugin up to version 4.5.11. Allows an attacker to inject malicious scripts.

Risk Assessment

An attacker can steal user session data, change store settings, or redirect customers to fake pages.

Recommendation

Update the Dynamic Pricing With Discount Rules for WooCommerce plugin to the latest version. Use input filtering and CSP headers.

Other vulnerabilities in Dynamic Pricing With Discount Rules for WooCommerce

CVE-2026-13725High
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before version 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) against a victim who is induced to send a crafted request.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.