CVE-2026-104727Published
Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-104727 · Microsoft / collected KEV context
cve-program · CVE-2026-104727
- https://www.wordfence.com/threat-intel/vulnerabilities/id/942bceac-0587-4e74-bf3e-12d56dbb2186?source=cve
- https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/templates/conditions.php#L57
- https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/templates/conditions.php#L92
- https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/includes/functions.php#L520
- https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/berocket/includes/custom_post.php#L356
- https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.6.5/includes/custom_post.php#L85
- https://plugins.trac.wordpress.org/browser/sequential-order-numbers-for-woocommerce/tags/3.7
Related operational evidence
Explicit CVE identifiers- Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys · Newly collected advisory · 29 Oct 2026