Live › vulnerability › CVE-2026-104727
The Sequential Order Numbers for WooCommerce WordPress plugin, versions up to and including 3.6.5, fails to sanitize the 'condition' post meta array keys. An authenticated contributor can store scripts that run in the browser of any user who opens the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 10:24 UTC. All times on this page are UTC.
Sites running the Sequential Order Numbers for WooCommerce plugin at version 3.6.5 or lower. Exposure needs an account with contributor-level access or above, so sites without contributor accounts are lower risk. The sources do not state a fixed version.
No product ranges from the sources yet.
Sequential Order Numbers for WooCommerce plugin is installed and its version is 3.6.5 or lower in the WordPress plugins screenNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · in your agent: get_signal("CVE-2026-104727")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.