CVE-2026-3574

The Experto Dashboard for WooCommerce plugin for WordPress (versions up to 1.0.4) contains a Stored Cross-Site Scripting vulnerability affecting multiple settings fields including font size and weight parameters. The flaw stems from insufficient input sanitization and missing output escaping in the plugin's settings implementation. This vulnerability is limited to multi-site WordPress installations or those with the unfiltered_html capability disabled. The vulnerability carries a CVSS score of 4.4 (Medium severity) with a network-based attack vector requiring high privileges and no user interaction. An authenticated Administrator-level attacker could inject malicious scripts into plugin settings that execute whenever any user accesses the settings page. The impact includes potential compromise of confidentiality and integrity, though availability is not affected. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog, and it maintains an extremely low EPSS score of 0.00044, indicating minimal likelihood of exploitation. Community attention remains low, and no public exploit code has been reported, suggesting this represents a low-priority threat requiring patching as part of routine maintenance rather than emergency response.