CVE-2026-13440 describes a stored cross-site scripting vulnerability in the StoreGrowth: Smart Sales Booster for WooCommerce plugin, affecting all versions up to and including 2.1.0. The vulnerability is due to improper neutralization of input in the 'message_popup' parameter, allowing unauthenticated attackers to inject malicious scripts. The exploit is enabled because the 'ajd_protected' nonce, which should restrict access to the create_popup handler, is exposed to all unauthenticated frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce, effectively bypassing nonce-based access control mechanisms.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of users visiting the affected site. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires no user interaction (no UI) to exploit. The CVSS 3.1 base score is 7.2 (high severity) reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable plugin functionality. Monitoring vendor channels for updates is recommended. Because the vulnerability involves nonce exposure and input sanitization, remediation will likely require an official patch addressing these issues.