PT-2026-63572 · Fantasticplugins · Points/Rewards For Woocommerce

CVE-2026-7534 · Published 2026-07-23 · Updated 2026-07-23

Mitre

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user has cap filter in the SRP REST Earning Controller class unconditionally granting the custom rs earning read capability to all users — including unauthenticated visitors — combined with missing sanitization of the reason parameter in the create items() function and missing output escaping in the column default() method of SRP Master Log. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7534

Affected Products

Points/Rewards For Woocommerce

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-7534 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/366b5051-d042-4425-9aad-b77d93bcd485?source=cve · Note
• https://codecanyon.net/item/sumo-reward-points-woocommerce-reward-system/7791451 · Note