CVE-2026-59556 HIGH

CVE-2026-59556: WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability

Vendor Acowebs
Product Dynamic Pricing With Discount Rules for WooCommerce
Weakness CWE-79 · XSS
Published July 27, 2026
Last update July 27, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Dynamic Pricing With Discount Rules for WooCommerce plugin through version 4.5.11 contains a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability requires user interaction—typically clicking a malicious link—and can affect multiple users across the site. Update to a version newer than 4.5.11 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in visitors' browsers, potentially stealing session tokens or redirecting users.

Potential impact on your site

04Site Impact

Visitors and admins could be redirected, have sessions hijacked, or see fake content injected into your site.

Conditions required to exploit

05Prerequisites

Attacker needs to trick a user into clicking a malicious link or visiting a compromised page.

Key dates

06Disclosure timeline

July 27, 2026 CVE published
July 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15644 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 CVE-2026-65492 WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-17571 Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' CVE-2026-65511 WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability