Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description
The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_cog_product_cost' and 'alg_wc_cog_product_profit' shortcodes in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=4.1.0What Changed in the Fix
Changes introduced in v4.1.1
Source Code
WordPress.org SVN# CVE-2026-6962: Research & Exploitation Plan ## 1. Vulnerability Summary The **Cost of Goods: Product Cost & Profit Calculator for WooCommerce** plugin (versions <= 4.1.0) is vulnerable to **Stored Cross-Site Scripting (XSS)** via the `[alg_wc_cog_product_cost]` and `[alg_wc_cog_product_profit]` s…
Show full research plan
CVE-2026-6962: Research & Exploitation Plan
1. Vulnerability Summary
The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin (versions <= 4.1.0) is vulnerable to Stored Cross-Site Scripting (XSS) via the [alg_wc_cog_product_cost] and [alg_wc_cog_product_profit] shortcodes.
The vulnerability exists in includes/class-alg-wc-cog-products.php. While the plugin attempts to sanitize the html_template and profit_template attributes using wp_kses_post(), it performs a html_entity_decode() on the user-supplied attributes before sanitization and then performs a str_replace() to inject content after the template has been sanitized. This logic allows an authenticated user with Contributor+ permissions (who can create posts and use shortcodes) to inject arbitrary web scripts if the sanitization can be bypassed or if the substitution logic is flawed.
2. Attack Vector Analysis
- Shortcodes:
[alg_wc_cog_product_cost]and[alg_wc_cog_product_profit] - Vulnerable Attributes:
html_templateandprofit_template - Authentication: Contributor or higher.
- Preconditions: The shortcodes must be enabled in the plugin settings (defaults to 'no' in some versions, but often
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.