WordPress Plugin Vulnerabilities

Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax

Description

The plugin does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Proof of Concept

Affects Plugins

Plugin icon
aco-woo-dynamic-pricing
Fixed in 5.0.0

References

CVE
CVE-2026-13725

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
5e3786de-4b4d-4da2-b129-7b0fef90a386

Timeline

Publicly Published
2026-07-20 (about 7 days ago)
Added
2026-07-20 (about 6 days ago)
Last Updated
2026-07-20 (about 6 days ago)

Other

Published
Title
Published
2025-01-14
Title
iBuildApp <= 0.2.0 - Reflected XSS
Published
2025-02-18
Title
Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Reflected Cross-Site Scripting
Published
2024-06-26
Title
Portfolio Gallery – Image Gallery Plugin < 1.6.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Published
2026-02-03
Title
Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSS
Published
2025-04-04
Title
Link Library < 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters