High · 7.1 CVE-2026-57396 EUVD-2026-43469GHSA-7fj5-rhr8-6vw4

WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability

Published Jul 13, 2026 · Updated Jul 13, 2026 · Assigned by Patchstack

Vendor: Flintop Product: Free Gifts for WooCommerce Category: Web / CMS

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.

Affected products

Vendor	Product	Affected	Fixed
Flintop	Free Gifts for WooCommerce	≤ 13.1.0	—

References

https://patchstack.com/database/Wordpress/Plugin/free-gifts-for-woocommerce/vulnerability/wordpress-free-gifts-for-woocommerce-plugin-13-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry