{"id":"CVE-2026-12402","aliases":["EUVD-2026-83553","GHSA-wm5w-wf8v-v7qm"],"status":"published","title":"OTP Login \u0026 Register Woocommerce \u003c= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting","description":"The OTP Login \u0026 Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00311,"percentile":0.24233,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-19T07:43:18Z","modified":"2026-09-21T13:33:33Z","products":[{"vendor":"xootix","product":"otp login \u0026 register woocommerce"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4bfd2f-6277-47d6-80ac-957b93476ed1?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.7.2/includes/class-xoo-ml-frontend.php#L153"},{"url":"https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.7.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L306"},{"url":"https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.7.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L411"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3682327%40mobile-login-woocommerce\u0026new=3682327%40mobile-login-woocommerce"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12402"},{"url":"https://github.com/advisories/GHSA-wm5w-wf8v-v7qm"}],"sources":{"cve":[{"id":"CVE-2026-12402","title":"OTP Login \u0026 Register Woocommerce \u003c= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting","description":"The OTP Login \u0026 Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.","status":"published","published":"2026-09-19T07:43:18.822Z","modified":"2026-09-19T14:01:22.108Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-83553","description":"The OTP Login \u0026 Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.","status":"published","published":"2026-09-19T07:43:18Z","modified":"2026-09-19T14:01:22Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:06.658724Z"}],"ghsa":[{"id":"GHSA-wm5w-wf8v-v7qm","title":"The OTP Login \u0026 Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site...","description":"The OTP Login \u0026 Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.","status":"published","published":"2026-09-19T09:32:10Z","modified":"2026-09-19T09:32:12Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:13.368323Z"}],"nvd":[{"id":"CVE-2026-12402","description":"The OTP Login \u0026 Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.","status":"published","published":"2026-09-19T08:16:51.907Z","modified":"2026-09-21T13:33:33.387Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:50.043898Z"}]}}