CVE-2026-3574
Stored XSS in Experto Dashboard WooCommerce Plugin Settings
Publication date: 2026-04-09
Last updated on: 2026-04-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| woocommerce | experto_dashboard | to 1.0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability allows an attacker with Administrator-level access to inject arbitrary web scripts into the plugin settings page.
When other users access the settings page, the injected scripts will execute in their browsers, potentially leading to session hijacking, unauthorized actions, or data theft.
Because the vulnerability requires high privileges and affects multi-site or restricted HTML installations, the risk is somewhat limited but still significant in those environments.
Can you explain this vulnerability to me?
The Experto Dashboard for WooCommerce plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its settings fields such as 'Navigation Font Size', 'Navigation Font Weight', 'Heading Font Size', 'Heading Font Weight', 'Text Font Size', and 'Text Font Weight'.
This vulnerability exists because the plugin does not properly sanitize user input (no sanitize callback in register_setting()) and does not escape output correctly (no esc_attr() in the field_callback() printf output).
As a result, authenticated users with Administrator-level access or higher can inject malicious scripts into the plugin's settings page. These scripts execute whenever any user accesses that settings page.
This issue affects multi-site WordPress installations and installations where the unfiltered_html capability has been disabled.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Experto Dashboard for WooCommerce plugin to a version later than 1.0.4 where the issue is fixed.
Additionally, restrict Administrator-level access to trusted users only, since exploitation requires such privileges.
Consider enabling input sanitization and output escaping in the plugin settings fields if you maintain the plugin code.
Also, be aware that this vulnerability only affects multi-site installations and installations where unfiltered_html is disabled.