CVE-2026-39750: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in weDevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart

This vulnerability (CVE-2026-39750) is an improper neutralization of input during web page generation (CWE-79) in the StoreGrowth: Smart Sales Booster for WooCommerce plugin, versions up to 2.0.6. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with low confidentiality, integrity, and availability impacts.

The vulnerability enables unauthenticated attackers to inject malicious scripts into web pages generated by the affected plugin, which can lead to execution of arbitrary scripts in the context of users visiting the site. This can result in partial loss of confidentiality, integrity, and availability as indicated by the CVSS score. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin. Monitor official vendor channels for updates and apply any official fixes promptly once released.