CVE-2026-10104: Stored XSS in Product Video Gallery for Woocommerce Plugin

Technical summary

CVE-2026-10104 is a Stored XSS vulnerability (CWE-79) in the Product Video Gallery for Woocommerce plugin. The vulnerability stems from insufficient input sanitization and output escaping of the custom_thumbnail parameter. The attack vector is network-based with high privilege requirements (shop manager role or above) and does not require user interaction from the attacker, though it does require high complexity to exploit. The impact is limited to confidentiality and integrity concerns with no availability impact, as reflected in the CVSS 3.1 score of 4.4 (MEDIUM severity). The vulnerability can affect multiple security contexts due to its scope change characteristic.

Business impact

While the CVSS score is moderate, this vulnerability poses a targeted but meaningful risk to e-commerce operations. Compromised gallery pages could be used to steal customer session tokens, payment information, or redirect users to phishing sites. The requirement for shop manager access limits the attacker pool to internal threats or compromised admin accounts, but the stored nature of the XSS means the malicious payload persists until remediated. For merchants relying on Product Video Gallery, this represents a compliance risk under PCI-DSS and similar frameworks, as customer data could be exfiltrated through injected scripts.

Affected systems

The Product Video Gallery for Woocommerce plugin is affected in all versions up to and including 1.5.1.8. Any WordPress installation running this plugin with that version or earlier is at risk if shop manager accounts or higher-privileged roles exist. The vulnerability requires authentication, so unauthenticated attackers cannot exploit it directly; however, compromised or malicious shop manager accounts can weaponize it immediately.

Exploitability

Exploitation requires authentication as a shop manager or administrator, which raises the barrier to entry. However, the lack of user interaction required from the attacker (UI:N in the CVSS vector) and the high complexity rating suggest the attack is not trivial but is feasible for someone with legitimate access or who has compromised such credentials. Once exploited, the payload is stored and automatically executes for all subsequent visitors, making it a persistent threat requiring no ongoing attacker presence.

Remediation

Update the Product Video Gallery for Woocommerce plugin to a version patched after 1.5.1.8. Verify the available patch version against the official WordPress plugin repository or the vendor's security advisory before deploying. Additionally, review shop manager and administrator account access logs to detect any suspicious gallery modifications, and conduct a security audit of existing galleries for signs of injected script content. Consider restricting shop manager role permissions if not all such users require gallery modification capabilities.

Patch guidance

Check the official WordPress plugin repository for the Product Video Gallery for Woocommerce to identify the patched version released after 1.5.1.8. Apply the update through the WordPress admin dashboard. Before updating in production, test the patch in a staging environment to ensure no compatibility issues with your site's theme, other plugins, or custom configurations. After patching, audit all product galleries for malicious content and consider invalidating user sessions as a precautionary measure.

Detection guidance

Search your WordPress admin logs and database audit trails for modifications to product video galleries by shop manager accounts, particularly changes to the custom_thumbnail parameter. Use WordPress security plugins with XSS detection capabilities to scan gallery pages for suspicious script tags or event handlers. Network-level monitoring should flag unusual outbound requests from your e-commerce platform, as injected scripts may attempt data exfiltration. Perform content security policy (CSP) reviews to identify whether your site's CSP would have blocked such injected scripts.

Why prioritize this

Although the CVSS score is 4.4 (MEDIUM), prioritize patching based on your organization's reliance on the Product Video Gallery plugin and the sensitivity of customer data handled by your store. The stored nature of the XSS and persistence across all page visitors makes this a long-duration threat. If you do not use this plugin, prioritization can be lower. If the plugin is actively used and your shop manager base includes contractors or third-party vendors, elevate priority due to insider threat risk.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects low to medium severity due to high privilege requirements (PR:H) and high attack complexity (AC:H), which significantly reduce the practical exploitability. However, the scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable component, and the stored XSS nature means impact persists. The score does not account for business context; organizations handling payment card data should treat this more seriously than the numerical score suggests.

Frequently asked questions