CVE-2026-7534: Unauthenticated Stored XSS in SUMO Reward Points for WooCommerce

Vulnerability Overview Vulnerability Name: SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter CVE Number: CVE-2026-7534 CVSS Score: 7.2 (High) Publication Date: July 22, 2026 Last Updated: July 23, 2026 Researcher: Nguyen Cong Quang Affected Scope Software Type: Plugin Software Name: SUMO Reward Points for WooCommerce Affected Versions: <= 32.7.0 Fixed Version: 32.8.0 Remediation Remediation Advice: Update to version 32.8.0 or a later patched version. Vulnerability Description The SUMO Reward Points plugin for WordPress contains an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in versions <= 32.7.0, accessible via the REST API endpoint . This vulnerability arises because the class unconditionally grants the custom capability to all users, including unauthenticated visitors. This is compounded by a lack of sanitization for the parameter in the function and missing output escaping in the method. Consequently, unauthenticated attackers can inject arbitrary web scripts into the reward points logs, which will execute whenever an administrator accesses the Master Log or the User Reward Points management page. References codecanyon.net Additional Information Recently Discovered Vulnerabilities: - Vulnerability Name: SUMO Reward Points <= 30.7.0 - Unauthenticated Local File Inclusion - CVE Number: CVE-2025-32925 - CVSS Score: 9.8 - Researcher: Bonds - Publication Date: April 21, 2025 Summary This vulnerability allows unauthenticated attackers to execute malicious scripts via stored Cross-Site Scripting (XSS) in the SUMO Reward Points for WooCommerce plugin. It is recommended to update to version 32.8.0 or later as soon as possible to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-7534: Unauthenticated Stored XSS in SUMO Reward Points for WooCommerce

More from this source