CVE-2026-13718
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: WPScan

Description
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-19
AI Q&A
2026-10-02
EPSS Evaluated
2026-10-18
NVD
CVE-2026-13718
EUVD
EUVD-2026-91190

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Tabs Responsive 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Tabs Responsive WordPress plugin version 2.5 or lower. It occurs because the plugin fails to sanitize the content of WooCommerce product tabs before storing or displaying it. A shop manager with elevated privileges can inject malicious JavaScript into product tab content, which executes when any user, including administrators, views the affected product page.

Detection Guidance

Check for the presence of the Tabs Responsive WordPress plugin version 2.5 or lower. Inspect WooCommerce product tab content for unusual JavaScript or HTML code that may indicate malicious injection.

Impact Analysis

The vulnerability allows an attacker with shop manager privileges to inject malicious JavaScript into product pages. When users or administrators view these pages, the script executes, potentially leading to unauthorized actions, data theft, or other malicious activities such as session hijacking or defacement.

Compliance Impact

This vulnerability could lead to unauthorized data access or theft, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited in relevant environments.

Mitigation Strategies

Disable the Tabs Responsive plugin immediately if it is installed and version 2.5 or lower. Review all WooCommerce product tab content for suspicious scripts. Monitor for unauthorized actions or data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13718. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart