Overview
A high-severity stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-103899, has been disclosed in EU VAT Assistant for WooCommerce, a plugin by developer daigo75 that validates EU VAT numbers and handles VAT-exempt checkout for WooCommerce stores. The flaw carries a CVSS 3.1 score of 7.2 and affects all versions through 2.1.30.260413.
The vulnerability sits in the plugin's vat_number checkout field, which is stored without adequate sanitization and rendered without output escaping when a store administrator later views the order. Because no authentication is required to place an order, any site visitor can plant the payload — and it fires automatically against an administrator's privileged browser session.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-103899 |
| CVSS 3.1 Score | 7.2 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| CWE | CWE-79 — Improper Neutralization of Input During Web Page Generation (XSS) |
| Attack Vector | Network |
| Authentication | None required |
| Privileges Required | None |
| User Interaction | Required — a store administrator (or other privileged user) must view the tainted order |
| Affected Field | vat_number (WooCommerce checkout) |
| Vulnerable Files | order-vat-info-box.php, order.php, vat_number_validator.php, plugin-main.php |
| Affected Versions | EU VAT Assistant for WooCommerce, all versions through 2.1.30.260413 |
| Assigner | Wordfence |
| Reserved / Published / Updated | 2026-10-01 / 2026-10-17 / 2026-10-17 |
How It Works
EU VAT Assistant collects a vat_number value at WooCommerce checkout to validate a buyer's EU VAT registration and apply the appropriate tax treatment. The plugin's input sanitization and output escaping for this field are insufficient, so a buyer can submit a VAT number value that is, in fact, a JavaScript payload rather than a real VAT ID.
Unlike reflected XSS, which needs a victim to click a crafted link, this is a stored flaw: the malicious value is saved with the order and only fires later, automatically, whenever a privileged user opens that order in wp-admin — specifically, when the VAT info box renders the stored value on the order edit screen. Because WooCommerce order management runs with administrator-level capabilities, a successful payload executes in a context that can manage users, plugins, and site configuration.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | Low per the published vector, though session-riding from an admin context can expose further data |
| Integrity | Low direct impact, but a script running as an administrator can be chained into privilege escalation (e.g. creating a new admin user, installing a plugin) |
| Availability | None directly scored |
| Authentication Required | None for the attacker; a victim admin must open the order to trigger the payload |
| Automatable | Yes — placing orders with a malicious vat_number is trivial to script against a live checkout |
Who Is At Risk
- Any WooCommerce store running EU VAT Assistant through version 2.1.30.260413
- Stores based in or selling into the EU, where VAT-exempt checkout flows using this plugin are common
- Store staff who routinely open order details in
wp-adminto review or fulfill VAT-exempt orders
Attack Chain
- Order submission — Attacker places an order through the storefront checkout, entering a crafted JavaScript payload in the
vat_numberfield instead of a real VAT ID. - Storage — The plugin persists the unsanitized value with the order record.
- Trigger — A store administrator opens the order in
wp-adminto review or process it, rendering the VAT info box. - Execution — The payload runs in the administrator's authenticated browser session, enabling session hijacking, admin-account creation, or further site compromise.
Mitigation
Immediate Actions
- Update EU VAT Assistant for WooCommerce to a version later than 2.1.30.260413, which adds proper input sanitization and output escaping to the
vat_numberfield. - Until patched, review recent orders for
vat_numbervalues containing<script>,javascript:,onerror=, or similar markers, and manually clean any affected order records.
Detection Opportunities
- Monitor checkout submissions for
vat_numbervalues that fail a basic EU VAT-format check but contain HTML/JS metacharacters (<,>,",javascript:). - Watch browser-side error logs or Content Security Policy (CSP) violation reports from
wp-adminorder-edit pages for blocked inline-script attempts.
Defence-in-Depth
- Deploy a Web Application Firewall rule blocking common XSS payload patterns in the
vat_numbercheckout parameter. - Enable a strict Content Security Policy on
wp-adminpages to limit inline script execution even if a payload is stored. - Limit the number of staff accounts with order-management capability, reducing how often a tainted order gets opened by a high-privilege session.
Background
EU VAT Assistant for WooCommerce is a plugin by developer daigo75 that automates EU VAT number validation (via the EU's VIES service) and VAT-exemption handling for WooCommerce stores selling to business customers across the EU. Because VAT number fields are rarely treated as "untrusted user content" in the same way a comment or review field would be, they are an easy field for output-escaping gaps to slip through — as this advisory demonstrates.