CVE-2026-100316: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in davidanderson European VAT Compliance Assistant for WooCommerce

CVE-2026-100316 is a stored cross-site scripting vulnerability (CWE-79) in the European VAT Compliance Assistant for WooCommerce plugin for WordPress. The flaw exists because the plugin does not properly sanitize or escape the CF-IPCountry HTTP header value before storing it in order post-meta during guest checkout. Since the payload is stored persistently and no authentication is required to inject it, attackers can execute arbitrary scripts in the context of users visiting the injected pages. This affects all plugin versions from 0 up to and including 1.36.10.

An unauthenticated attacker can inject malicious JavaScript code that will execute in the browsers of users who view the affected pages. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, consider implementing web application firewall (WAF) rules to block or sanitize the CF-IPCountry header or restrict guest checkout functionality. Avoid exposing affected plugin versions publicly where possible.