CVE-2026-17161 describes a stored cross-site scripting vulnerability in the WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress. The flaw exists in the handling of the 'filterMobileText' block attribute, where insufficient input sanitization and output escaping allow authenticated contributors or higher to inject arbitrary web scripts. The sanitization method wp_kses_post fails because the malicious payload is embedded inside a Gutenberg block delimiter comment as JSON, which wp_kses_post does not sanitize properly. This enables the injected scripts to survive to the server-side render callback and execute in the context of users viewing the page.

An attacker with contributor-level or higher privileges can inject malicious scripts into pages via the vulnerable attribute. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected block attribute. Monitor vendor channels for official patches or updates addressing this vulnerability.