{"id":"CVE-2026-104727","kind":"vulnerability","aliases":["CVE-2026-104727"],"related":[],"title":"WooCommerce Sequential Order Numbers plugin: stored script injection via post meta","description":"The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Sequential Order Numbers for WooCommerce WordPress plugin, versions up to and including 3.6.5, fails to sanitize the 'condition' post meta array keys. An authenticated contributor can store scripts that run in the browser of any user who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["auth-required","plugin-not-installed"],"how_to_check":"- Check whether the `Sequential Order Numbers for WooCommerce` plugin is installed and its version is `3.6.5` or lower in the WordPress plugins screen","fix":null,"status":"open","published_at":"2026-10-29T10:17:02+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","triaged_at":"2026-10-29T10:25:22+00:00","updated_at":"2026-10-29T10:25:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T10:25:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce Sequential Order Numbers plugin: stored script injection via post meta","impact":"medium","summary":"The Sequential Order Numbers for WooCommerce WordPress plugin, versions up to and including 3.6.5, fails to sanitize the 'condition' post meta array keys. An authenticated contributor can store scripts that run in the browser of any user who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' and admins' browsers on the site","analyst_note":"Check the NVD entry and the WordPress plugin changelog for a fixed version beyond 3.6.5.","how_to_check":"- Check whether the `Sequential Order Numbers for WooCommerce` plugin is installed and its version is `3.6.5` or lower in the WordPress plugins screen\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","auth-required"],"who_is_affected":"Sites running the Sequential Order Numbers for WooCommerce plugin at version 3.6.5 or lower. Exposure needs an account with contributor-level access or above, so sites without contributor accounts are lower risk. The sources do not state a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4189,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104727':14A,17A '-2026':13A,16A '3.6.5':37B,96C 'access':116C,132C 'arbitrari':121C 'array':45B,87C 'attack':111C 'authent':48B,110C 'browser':57B 'condit':42B,84C 'contributor':49B,114C 'contributor-level':113C 'cross':80C 'cross-sit':79C 'cve':12A,15A 'due':97C 'escap':104C 'execut':128C 'fail':38B 'host':21B 'includ':36B,95C 'inject':8A,64B,120C,134C 'input':100C 'insuffici':99C 'key':46B,88C 'level':115C 'make':106C 'meta':11A,44B,86C 'number':4A,27B,69C 'open':62B 'order':3A,26B,68C 'output':103C 'packag':18B 'page':65B,125C,135C 'plugin':5A,31B,72C 'possibl':108C 'post':10A,43B,85C 'run':54B 'sanit':40B,101C 'script':7A,52B,82C,123C 'self':20B 'self-host':19B 'sequenti':2A,25B,67C 'site':81C 'store':6A,51B,78C 'user':60B,131C 'version':32B,91C 'via':9A,83C 'vulner':76C 'web':122C 'whenev':129C 'woocommerc':1A,22B,29B,71C 'wordpress':23B,30B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Sequential Order Numbers for WooCommerce plugin at version 3.6.5 or lower. Exposure needs an account with contributor-level access or above, so sites without contributor accounts are lower risk. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T10:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104727","severity":null,"published_at":"2026-10-29T10:17:02+00:00","modified_at":"2026-10-29T10:17:02+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","fetched_at":"2026-10-29T10:24:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}