CVE-2026-100316 davidanderson CVE debrief

Who should care

Defenders responsible for WordPress installations with the European VAT Compliance Assistant for WooCommerce plugin should assess exposure and prioritize verification of current input sanitization and output escaping measures.

Why it matters

CVE-2026-100316 allows unauthenticated Stored Cross-Site Scripting via the CF-IPCountry Header in WooCommerce plugin versions up to 1.36.10. Defenders should verify exposure, assess input sanitization, and prioritize updates to prevent script injection and execution.

• Unauthenticated attackers can inject arbitrary web scripts
• Scripts execute when a user accesses an injected page
• Malicious header values persist in order post-meta during guest checkout
• Verify exposure of WooCommerce plugin versions up to 1.36.10

Technical summary

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Defenders should prioritize verifying exposure of WooCommerce plugin versions up to 1.36.10 and assess the effectiveness of current input sanitization and output escaping measures.

Recommended defensive actions

• Verify WooCommerce plugin versions up to 1.36.10 for exposure
• Assess current input sanitization and output escaping measures
• Update to a fixed version when available
• Monitor for suspicious activity related to the CF-IPCountry Header
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish specific exploitation instances or remediation steps beyond version updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.