CVE-2026-17161

Name of the Vulnerable Software and Affected Versions WowStore – Store Builder & Product Blocks for WooCommerce versions prior to 4.4.25

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. The issue occurs via the filterMobileText block attribute. The wp kses post sanitization function is ineffective because the payload is stored as JSON within a Gutenberg block delimiter comment, which allows an attribute-breakout string to reach the server-side render callback() function. This enables the injection of arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update to a version newer than 4.4.24.