CVE-2026-103899: EU VAT Assistant for WooCommerce
- Severity
- 7.2 (HIGH)
- Vendor
- DAIGO75
- Affected versions
- 0 through 2.1.30.260413
- Patch status
- Unknown
- Published
- 2026-10-17T04:16:47.413
- Modified
- 2026-10-17T04:16:47.413
Why it matters
This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Check whether the affected WordPress plugin or theme is installed.
- Update, disable, or remove the affected component if present.
- Treat internet-facing systems as higher priority.
- Review logs for suspicious activity related to the affected application or component.
Technical summary
The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.
View the official NVD record for CVE-2026-103899
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
278 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-85746 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85748 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-92262 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-49868 |
RIOT PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-111823 |
Mage OSS PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104736 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-102693 |
RIOT PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-57169 |
dockhand PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-109587 |
FreeRTOS-Kernel PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109588 |
FreeRTOS-Kernel PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111626 |
Damselfly
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111641 |
FastapiAdmin
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111643 |
misaka_danmu_server
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111673 |
IceCMS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111687 |
we-mp-rss
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111690 |
Simple Admin Core
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111692 |
databuff
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111693 |
databuff
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111704 |
langchat
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111708 |
whaticket-community
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111711 |
Netcore NR256CN
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102551 |
FreeRTOS-Plus-TCP PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111636 |
OpenBMB StaffDeck
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111663 |
Chaskiq
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-96620 |
claude-agent-sdk-python PATCH
Reporter: SECURITY-ADVISORIES
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102692 |
RIOT PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111675 |
course-tencent-cloud
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111691 |
wimoor
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-110653 |
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-44977 |
countly-server PATCH
Reporter: SECURITY-ADVISORIES
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-102608 |
zoneminder PATCH
Reporter: SECURITY-ADVISORIES
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-97380 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111633 |
ZKEACMS
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111650 |
ChronoFrame
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102607 |
zoneminder PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-30971 |
zoneminder PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-96627 |
Arcane is an interface for managing Docker containers, images, networks, and volumes PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111853 |
An issue was discovered on Tektronix 3 Series MDO devices PATCH
Reporter: CVE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-68906 |
src/mms/iso acse/acse.c checks len for zero PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-95859 |
libp2p-rust is the official Rust language implementation of the libp2p networking stack PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111612 |
netdisk-fast-download
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111613 |
AllData
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111642 |
FastapiAdmin
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111681 |
EFAK
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111685 |
IceCMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111686 |
IceCMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111702 |
chat-ollama
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111706 |
Product identification pending
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111710 |
Netcore NR256CN
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111723 |
LingGuo-Drama
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111605 |
Jpom
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111606 |
Huly Platform
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111627 |
HestiaCP PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111634 |
Helical Insight
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111639 |
bbs-go
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111722 |
LingGuo-Drama
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-55543 |
TuxGuitar is an open-source guitar tablature editor PATCH
Reporter: SECURITY-ADVISORIES
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-96626 |
Arcane is an interface for managing Docker containers, images, networks, and volumes PATCH
Reporter: SECURITY-ADVISORIES
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-111638 |
sshportal
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-111701 |
OtterMind Nubase
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-68907 |
libiec61850 PATCH
Reporter: SECURITY-ADVISORIES
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-86009 |
Mailu
Reporter: SECURITY-ADVISORIES
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-102552 |
FreeRTOS-Plus-TCP PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-111646 |
SurveyKing PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-111719 |
roncoo-pay
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-42269 |
countly-server is the server-side part of Countly, a product analytics solution PATCH
Reporter: SECURITY-ADVISORIES
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-61726 |
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists PATCH
Reporter: SECURITY-ADVISORIES
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-49410 |
OpenHuman is an open-source agent harness available as a desktop application and Rust library PATCH
Reporter: SECURITY-ADVISORIES
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-111854 |
An issue was discovered on Tektronix 3 Series MDO devices PATCH
Reporter: CVE
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-92798 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-96424 |
lomiri-download-manager
Reporter: CVE
|
7.8
HIGH
|
VIEW RECORD |
| CVE-2026-102917 |
IBM i 7.3, 7.4, 7.5, and 7.6
Reporter: PSIRT
|
7.8
HIGH
|
VIEW RECORD |
| CVE-2026-86047 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-59970 |
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists PATCH
Reporter: SECURITY-ADVISORIES
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-108374 |
ERPNext is a free and open source Enterprise Resource Planning tool PATCH
Reporter: SECURITY-ADVISORIES
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-111622 |
smart-sso
Reporter: DISCLOSURE
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-111044 |
Sunshine PATCH
Reporter: SECURITY-ADVISORIES
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-102941 |
parser/parser.go slices url[:nPath] PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-41582 |
countly-server is the server-side part of Countly, a product analytics solution PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-42270 |
countly-server is the server-side part of Countly, a product analytics solution PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-46472 |
An issue was discovered in GStreamer gst-plugins-good PATCH
Reporter: CVE
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-48503 |
libiec61850 PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-48741 |
libiec61850 PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-57486 |
pupnp is an SDK for development of UPnP device and control point applications PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-57487 |
pupnp is an SDK for development of UPnP device and control point applications PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-77630 |
pupnp is an SDK for development of UPnP device and control point applications PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-102834 |
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-68498 |
jackson-core PATCH
Reporter: 36C7BE3B-2937-45DF-85EA-CA7133EA542C
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-111855 |
An issue was discovered on Tektronix 3 Series MDO devices PATCH
Reporter: CVE
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-107762 |
Kirki – Freeform Page Builder, Website Builder & Customizer
Reporter: SECURITY
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-108123 |
WP Booking System – Booking Calendar
Reporter: SECURITY
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-110889 |
Gantry Gantry 5 Framework gantry5
Reporter: AUDIT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-92263 |
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families PATCH
Reporter: SECURITY-ADVISORIES
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-86008 |
Mailu is a mail server distributed as a set of Docker images PATCH
Reporter: SECURITY-ADVISORIES
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111680 |
APIPark
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-111684 |
Magistrala
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-104734 |
Kirki – Freeform Page Builder, Website Builder & Customizer
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-109208 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-103899 |
EU VAT Assistant for WooCommerce
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-96660 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
7.2
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.