CVE-2026-6447 — Cross-Site Scripting (XSS)

title: CVE-2026-6447 - WooCommerce Call for Price Stored XSS via Admin Settings
id: scw-2026-05-02-ai-1
status: experimental
level: medium
description: |
  This rule detects attempts to exploit CVE-2026-6447 by identifying requests to the WordPress admin area that include parameters related to the 'Call for Price' WooCommerce plugin, specifically targeting settings pages where an attacker might inject script tags. This indicates a potential Stored Cross-Site Scripting attack targeting administrator settings.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6447/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin.php'
      cs-uri-query|contains:
          - 'page=call-for-price'
      cs-uri-query|contains:
          - 'action=edit'
      cs-uri-query|contains:
          - 'id='
      cs-uri-query|contains:
          - '<script>'
  selection_base:
      sc-status:
          - '200'
  condition: selection AND selection_base
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse