{
 "id": "WPSEC-2026-0472",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0472/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0472/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0472/index.md",
 "title": "WooCommerce EU VAT Assistant <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via VAT Number",
 "description": "The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the VAT number submitted at checkout in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization of the VAT number and missing output escaping of VAT evidence values in the admin order meta box. This makes it possible for unauthenticated attackers, such as guest customers placing an order, to inject arbitrary web scripts that will execute whenever an administrator or shop manager views the affected order.",
 "plugin": {
  "slug": "woocommerce-eu-vat-assistant",
  "name": "WooCommerce EU VAT Assistant",
  "full_name": "EU VAT Assistant for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-eu-vat-assistant/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-eu-vat-assistant/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-eu-vat-assistant"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.2.0.261001",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.2.0.261001"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.2.0.261001",
 "remediation": "Update to 2.2.0.261001 or later.",
 "fix_released": "2026-10-05T10:36:41+00:00",
 "published": "2026-10-06T19:43:53+00:00",
 "updated": "2026-10-06T19:05:38.479773+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0472/",
  "https://plugins.svn.wordpress.org/woocommerce-eu-vat-assistant/tags/2.2.0.261001/",
  "https://wordpress.org/plugins/woocommerce-eu-vat-assistant/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-eu-vat-assistant",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-06"
 }
}