{"id":"CVE-2026-122673","kind":"vulnerability","aliases":["CVE-2026-122673"],"related":[],"title":"ShopEngine WordPress plugin: stored XSS through versions up to 4.9.8","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.","summary":"ShopEngine, a WordPress plugin from Wpmet, has a stored cross-site scripting flaw in versions through 4.9.8. An attacker who can store crafted input on the site can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ShopEngine","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","shopengine","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed ShopEngine plugin version in the WordPress admin under Plugins.\n- Compare it with `4.9.8`; versions at or below it are listed as affected.","fix":null,"status":"open","published_at":"2026-11-09T13:17:07+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","triaged_at":"2026-11-09T13:27:35+00:00","updated_at":"2026-11-09T13:27:35+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T13:27:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ShopEngine WordPress plugin: stored XSS through versions up to 4.9.8","impact":"medium","summary":"ShopEngine, a WordPress plugin from Wpmet, has a stored cross-site scripting flaw in versions through 4.9.8. An attacker who can store crafted input on the site can run scripts in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","shopengine","woocommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers, enabling session theft or defacement","analyst_note":"Confirm fixed version and attacker privilege required from the Wordfence or WPScan advisory for ShopEngine; NVD gives only 'through 4.9.8'.","how_to_check":"- Check the installed ShopEngine plugin version in the WordPress admin under Plugins.\n- Compare it with `4.9.8`; versions at or below it are listed as affected.","plain_action":"","product_name":"ShopEngine","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ShopEngine WordPress plugin at version 4.9.8 or earlier. The sources do not say whether attacker-supplied input must come from a logged-in account or which ShopEngine features are involved.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4544,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122673':13A,16A '-2026':12A,15A '4.9.8':10A,39B,83C 'affect':78C 'allow':74C 'attack':41B 'browser':56B 'craft':45B 'cross':32B,66C 'cross-sit':31B,65C 'cve':11A,14A 'flaw':35B 'generat':64C 'improp':57C 'input':46B,60C 'issu':77C 'n/a':81C 'neutral':58C 'page':63C 'plugin':3A,25B 'run':51B 'script':34B,52B,68C 'shopengin':1A,19B,22B,72C,73C,79C 'shopengine':17A 'site':33B,49B,67C 'store':4A,30B,44B,75C 'version':7A,37B 'visitor':55B 'vulner':69C 'web':62C 'woocommerc':20B 'wordpress':2A,21B,24B 'wpmet':27B,71C 'xss':5A 'xss.this':76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ShopEngine WordPress plugin at version 4.9.8 or earlier. The sources do not say whether attacker-supplied input must come from a logged-in account or which ShopEngine features are involved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["shopengine"],"ptokens":["shopengine"],"labels":["medium","other","shopengine","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-122673':13A,16A '-2026':12A,15A '4.9.8':10A 'cve':11A,14A 'plugin':3A 'shopengin':1A 'shopengine':17A 'store':4A 'version':7A 'wordpress':2A 'xss':5A","search_b":"'4.9.8':39B 'attack':41B 'browser':56B 'craft':45B 'cross':32B 'cross-sit':31B 'flaw':35B 'input':46B 'plugin':25B 'run':51B 'script':34B,52B 'shopengin':19B,22B 'site':33B,49B 'store':30B,44B 'version':37B 'visitor':55B 'woocommerc':20B 'wordpress':21B,24B 'wpmet':27B","search_c":"'4.9.8':83C 'affect':78C 'allow':74C 'cross':66C 'cross-sit':65C 'generat':64C 'improp':57C 'input':60C 'issu':77C 'n/a':81C 'neutral':58C 'page':63C 'script':68C 'shopengin':72C,73C,79C 'site':67C 'store':75C 'vulner':69C 'web':62C 'wpmet':71C 'xss.this':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122673","severity":null,"published_at":"2026-11-09T13:17:07+00:00","modified_at":"2026-11-09T13:17:07+00:00","first_seen_at":"2026-11-09T13:26:50+00:00","fetched_at":"2026-11-09T13:26:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}