Executive Summary

CVE-2026-39508 is a Cross Site Scripting (XSS) vulnerability in the WordPress Advanced Coupons for WooCommerce Coupons Plugin versions up to and including 4.7.1.1.

This vulnerability allows attackers to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—that execute when site visitors access the compromised website.

Exploitation requires a user with at least Contributor or Developer privileges to perform an action like clicking a malicious link, visiting a crafted page, or submitting a form, meaning user interaction is necessary for the attack to succeed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of malicious scripts on your website, which may result in unwanted redirects, display of unauthorized advertisements, or other harmful HTML payloads.

Because the attack requires user interaction and certain user privileges, it may be limited in scope but can still compromise the integrity and trustworthiness of your website.

Although the vulnerability is considered a moderate risk with a CVSS score of 6.5, no impactful threat has been reported, and it is classified as a low priority by Patchstack.

Users are strongly advised to update to version 4.7.2 or later to mitigate the risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-39508 vulnerability, users should update the Advanced Coupons for WooCommerce Coupons plugin to version 4.7.2 or later, as this version contains the patch for the Cross Site Scripting (XSS) issue.

Additionally, Patchstack offers automated updates for vulnerable plugins, which can facilitate rapid protection against this vulnerability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a DOM-Based Cross-Site Scripting (XSS) issue in the Advanced Coupons for WooCommerce Coupons plugin up to version 4.7.1.1. Detection typically involves checking the plugin version installed on your WordPress site.

To detect if your system is vulnerable, you can verify the plugin version by running commands to list installed WordPress plugins and their versions.

• Use WP-CLI to check the plugin version: wp plugin list --status=active
• Look specifically for 'advanced-coupons-for-woocommerce-coupons' and check if the version is less than or equal to 4.7.1.1.

Additionally, monitoring web traffic for suspicious script injections or unexpected redirects on pages generated by this plugin may help detect exploitation attempts.

Since exploitation requires user interaction with crafted pages or links, scanning for unusual input handling or testing with security tools that simulate XSS payloads on affected pages can also assist in detection.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this Cross-site Scripting (XSS) vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0