CVE-2026-39508 Josh Kohlbach CVE debrief

Who should care

Users of Advanced Coupons for WooCommerce Coupons plugin version 4.7.1.1 or earlier should review and apply updates. Affected operators, platforms, and security teams should prioritize vulnerability management and ensure that compensating controls are in place.

Technical summary

The Advanced Coupons for WooCommerce Coupons plugin has a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 4.7.1.1. The vulnerability requires user interaction for exploitation and has a CVSS score of 6.5. Defenders should review and apply updates to prevent potential exploitation. Affected product deployments should be reviewed for potential exposure. Defenders should verify the scope of the vulnerability and apply updates or mitigations accordingly. The CVE record was published on 2026-04-08T09:16:24.937Z and has not been modified since then.

Defensive priority

Medium priority given the CVSS score of 6.5 and the potential for user interaction required for exploitation.

Recommended defensive actions

• Review and apply the latest updates for Advanced Coupons for WooCommerce Coupons plugin.
• Inventory checks for plugin version 4.7.1.1 or earlier.
• Consider compensating controls such as Web Application Firewalls.
• Monitor for suspicious user interactions on affected systems.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence is limited; primary official records indicate a Cross-site Scripting vulnerability exists. Further verification is recommended. The CVE record was published on 2026-04-08T09:16:24.937Z and has not been modified since then. Affected product deployments should be reviewed for potential exposure. Defenders should verify the scope of the vulnerability and apply updates or mitigations accordingly.

Official resources