CVE-2025-26878

Summary

CVE-2025-26878 is a Cross-site Scripting (XSS) vulnerability affecting Autoship Cloud for WooCommerce Subscription Products from versions n/a through 2.8.0.1. Hackers can exploit this issue by injecting malicious scripts into the application during web page generation. These scripts can then be executed in the user's browser, potentially stealing sensitive information or taking control of their account. This neutralization failure in the input data represents a significant risk to users of the affected product.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.