The vulnerability identified as CVE-2026-39508 affects the Advanced Coupons for WooCommerce Coupons plugin by Josh Kohlbach. It is a DOM-based Cross-site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker to inject and execute malicious scripts within the victim's browser context. The issue impacts versions up to 4.7.1.1. There is no CVSS score assigned, no vendor advisory or patch information available, and no known exploitation in the wild at this time.

Successful exploitation of this vulnerability could enable attackers to execute arbitrary JavaScript in the context of the affected website, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, no known exploits have been reported, and the actual impact depends on the attacker's ability to deliver malicious input to vulnerable endpoints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules that detect and block XSS attempts targeting this plugin. Monitoring plugin updates from the vendor is recommended to apply any forthcoming patches promptly.