CVE-2026-13725

Name of the Vulnerable Software and Affected Versions Dynamic Pricing With Discount Rules for WooCommerce versions prior to 5.0.0

Description An issue exists where the plugin fails to validate a nonce (a unique token used to prevent replay attacks) or user capabilities on an AJAX action. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), where malicious scripts are reflected off a web application to a victim's browser, by inducing a user to send a crafted request to the wdpAjax action.

Recommendations Update Dynamic Pricing With Discount Rules for WooCommerce to version 5.0.0 or later.