CVE-2026-13718
Received Received - Intake

Stored XSS in Tabs Responsive WordPress Plugin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: WPScan

Description
The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-13718
EUVD
EUVD-2026-91190

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tabs_responsive tabs_responsive to 2.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Tabs Responsive WordPress plugin version 2.5 or lower. It occurs because the plugin fails to sanitize the content of WooCommerce product tabs before storing or displaying it. A shop manager with elevated privileges can inject malicious JavaScript into product tab content, which executes when any user, including administrators, views the affected product page.

Detection Guidance

Check for the presence of the Tabs Responsive WordPress plugin version 2.5 or lower. Inspect WooCommerce product tab content for unusual JavaScript or HTML code that may indicate malicious injection.

Impact Analysis

The vulnerability allows an attacker with shop manager privileges to inject malicious JavaScript into product pages. When users or administrators view these pages, the script executes, potentially leading to unauthorized actions, data theft, or other malicious activities such as session hijacking or defacement.

Mitigation Strategies

Disable the Tabs Responsive plugin immediately if it is installed and version 2.5 or lower. Review all WooCommerce product tab content for suspicious scripts. Monitor for unauthorized actions or data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13718. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart