CVE-2025-26878

Vulnerability

Description The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress, up to version 2.8.0.1, contains a DOM-based Cross-Site Scripting (XSS) vulnerability. Improper neutralization of user-supplied input during web page generation enables attackers to inject arbitrary JavaScript or HTML into the application's DOM [1].

Exploitation

Details Exploitation requires user interaction, such as clicking a malicious link or visiting a crafted page [1]. An attacker with no special privileges (lower than required for typical admin actions) can trigger the vulnerability, though interaction from a privileged user is needed for successful execution [1]. The attack does not require authentication, making it accessible over the network.

Impact

Successful exploitation could allow an attacker to inject malicious scripts (e.g., redirects, advertisements, or other HTML payloads) that execute when visitors access the affected site [1]. This can lead to defacement, data theft, or further attacks against site users.

Mitigation

The vulnerability is fixed in version 2.8.1 [1]. Users are strongly advised to update the plugin immediately. For those unable to update, consulting a hosting provider or web developer is recommended [1]. Patchstack users can enable auto-updates for the plugin [1].