CVE-2026-7534

Name of the Vulnerable Software and Affected Versions SUMO Reward Points versions prior to 32.7.1

Description Unauthenticated Stored Cross-Site Scripting (XSS) occurs via the REST API endpoint /wp-json/wc-srp/v1/earning. The issue stems from the user has cap filter in the SRP REST Earning Controller class, which grants the rs earning read capability to all users, including unauthenticated visitors. This is combined with a lack of sanitization for the reason parameter in the create items() function and missing output escaping in the column default() method of SRP Master Log. Consequently, unauthenticated attackers can inject arbitrary web scripts into the reward points log, which execute when an administrator views the Master Log or User Reward Points admin pages.

Recommendations Update to a version newer than 32.7.0. Avoid using the reason parameter in the /wp-json/wc-srp/v1/earning endpoint until the update is applied.