CVE-2026-107711

Read full description

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by any Subscriber-level user because the plugin's admin_enqueue_scripts callback exposes the REST bearer token in the Dashboard page source via wp_localize_script() without a capability check, and the REST endpoint's permission_callback validates only that bearer token rather than performing a current_user_can() capability check.

CVSS 6.4 (MEDIUM)

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

2.2/10

General review priority; not probability

Evidence confidence: Insufficient evidence

Why this priority?

Technical severity: CVSS 6.4: +2.24
Fresh EPSS: 0.34%: +0.01

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 1 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Latest Vulnerabilities

Technical advisory · 31 Oct 2026, 10:16 · CVE-2026-107711 - FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 2.2 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs. Published 10 days ago. Exploitation evidence usually takes weeks to show up: a low reality score can mean there is no data yet, not that the flaw is mild.

Evidence in context

Confidence in exploitation evidence: Insufficient evidence
Priority basis: Exploitation in attacks unconfirmed; CVSS 6.4; EPSS 0.3%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, low privileges, no user interaction.
Observed activity: No exploitation observation is recorded.
Known scale: Not quantified.
Evidence confidence basis: Insufficient evidence

Score evaluated: 2026-11-05 13:59:52.374647+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

31 Oct 2026, 09:29

Score calculated

05 Nov 2026, 13:59