CVE-2026-17162 is a stored cross-site scripting vulnerability in the WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress. The flaw exists in the handling of the 'currentPostId' block attribute, where input is not properly sanitized or escaped before being rendered on pages. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The vulnerability affects all plugin versions up to and including 4.4.24.

Successful exploitation allows an attacker with contributor-level access or higher to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to information disclosure and limited integrity impacts within the affected WordPress environment. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the affected plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or mitigations.