CVE-2026-12402

Received Received - Intake

Stored XSS in OTP Login & Register WooCommerce Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-12402

Affected Vendors & Products

Vendor	Product	Version / Range
wpwhitesecurity	otp_login_register_woocommerce	to 2.7.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the OTP Login & Register Woocommerce WordPress plugin versions up to 2.7.3. It occurs due to insufficient input sanitization and output escaping in the 'fb-config' setting. Attackers with administrator-level access can inject malicious scripts into pages, which execute when users visit those pages.

Detection Guidance

This vulnerability can be detected by reviewing WordPress plugin files for the OTP Login & Register Woocommerce plugin versions up to 2.7.3. Check for unsanitized input in the 'fb-config' setting and look for injected scripts in page content. No specific commands are provided in the context.

Impact Analysis

Authenticated attackers with admin access can inject scripts that steal user sessions, deface websites, or redirect users to malicious sites. On multisite setups without unfiltered_html capability, even network super administrators could be targeted.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Both standards mandate safeguards against such exploits.

Mitigation Strategies

Immediately update the OTP Login & Register Woocommerce plugin to the latest version beyond 2.7.3. If updating is not possible, consider disabling the plugin until a patch is available. Review all administrator-level accounts for unauthorized changes and remove any suspicious scripts from pages.

Hi! I’m here to help you understand CVE-2026-12402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70