CVE-2026-122673mediumCWE-79

CVE-2026-122673: medium-severity vulnerability in Wpmet ShopEngine

WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability

Published

Follow this CVE+ Monitor ShopEngine

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
Wpmet · ShopEngine
Related CVEs — Wpmet ShopEngine

In the same product, most dangerous first.

CVE-2022-45371MEDIUMWordPress ShopEngine Plugin <= 4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%