CVE-2026-100316

7.2High

Published 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated remote attackers can execute arbitrary web scripts in the browser of any user or administrator viewing an infected order. Attackers only need network access to complete a guest checkout while spoofing the CF-IPCountry HTTP header.

Root cause

The plugin writes the unvalidated CF-IPCountry header directly into order post-meta and renders it back without sanitization or output escaping.

Affected systems

European VAT Compliance Assistant for WooCommerce plugin up to, and including, 1.36.10

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Update European VAT Compliance Assistant for WooCommerce to a version newer than 1.36.10. If an immediate update is not possible, sanitize or strip the CF-IPCountry header at your reverse proxy or web server layer before requests reach WordPress.

shell

$ wp plugin update woocommerce-eu-vat-compliance

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious header value is persisted verbatim into order post-meta during a guest checkout, meaning no account or authentication is required to plant the payload.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-100316