SUMO Reward Points for WooCommerce <= 32.7.0 — Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under SUMO Reward Points for WooCommerce.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 32.8.0, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch SUMO Reward Points for WooCommerce to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Nguyen Cong Quang.

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class unconditionally granting the custom `rs_earning_read` capability to all users — including unauthenticated visitors — combined with missing sanitization of the `reason` parameter in the `create_items()` function and missing output escaping in the `column_default()` method of `SRP_Master_Log`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jul 22, 2026

   CVE published

   Severity high, CVSS 7.2

2. Nov 13, 2026

   Record last updated