CVE-2026-7534
SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user_has_cap filter in the SRP_REST_Earning_Controller class unconditionally granting the custom rs_earning_read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create_items() function and missing output escaping in the column_default() method of SRP_Master_Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user_has_cap filter in the SRP_REST_Earning_Controller class unconditionally granting the custom rs_earning_read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create_items() function and missing output escaping in the column_default() method of SRP_Master_Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.
- Record
CVE-2026-7534- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-47877
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user_has_cap filter in the SRP_REST_Earning_Controller class unconditionally granting the custom rs_earning_read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create_items() function and missing output escaping in the column_default() method of SRP_Master_Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.
- Record
EUVD-2026-47877- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j42q-gjcw-f29h
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site...
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user_has_cap filter in the SRP_REST_Earning_Controller class unconditionally granting the custom rs_earning_read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create_items() function and missing output escaping in the column_default() method of SRP_Master_Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.
- Record
GHSA-j42q-gjcw-f29h- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user_has_cap filter in the SRP_REST_Earning_Controller class unconditionally granting the custom rs_earning_read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create_items() function and missing output escaping in the column_default() method of SRP_Master_Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.
- Record
CVE-2026-7534- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-7534 is a high vulnerability (CVSS 7.2) in Fantasticplugins Sumo Reward Points For Woocommerce, published July 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. No source names a fixed version.