---
id: "CVE-2026-104727"
kind: "vulnerability"
aliases: ["CVE-2026-104727"]
title: "WooCommerce Sequential Order Numbers plugin: stored script injection via post meta"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["auth-required", "plugin-not-installed"]
published_at: "2026-10-29T10:17:02+00:00"
first_seen_at: "2026-10-29T10:24:25+00:00"
updated_at: "2026-10-29T10:25:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104727", "first_seen_at": "2026-10-29T10:24:25+00:00"}]
---

# WooCommerce Sequential Order Numbers plugin: stored script injection via post meta

The Sequential Order Numbers for WooCommerce WordPress plugin, versions up to and including 3.6.5, fails to sanitize the 'condition' post meta array keys. An authenticated contributor can store scripts that run in the browser of any user who opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `Sequential Order Numbers for WooCommerce` plugin is installed and its version is `3.6.5` or lower in the WordPress plugins screen

## Timeline

- 2026-10-29T10:24:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104727

## From the sources

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_