{"metadata": {"vulnerability": "CVE-2026-103899", "count": 18, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-01T13:55:27.399Z", "date_only": false, "value": "2026-10-01T13:55:27.399Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103899", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-01T18:51:16Z", "date_only": false, "value": "2026-10-01T18:51:16.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103899", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-16T14:38:25Z", "date_only": false, "value": "2026-10-16T14:38:25.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103899", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-17T03:43:30.740Z", "date_only": false, "value": "2026-10-17T03:43:30.740Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103899", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-17T03:43:30.740Z", "date_only": false, "value": "2026-10-17T03:43:30.740Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103899", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-17T03:49:32.905Z", "date_only": false, "value": "2026-10-17T03:49:32.905747Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117454207202663170", "record": "CVE-2026-103899", "field": "creation_timestamp", "uuid": "ddc89447-dae9-48b7-8b46-f91f9f77433c", "content": "CVE-2026-103899 EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce \u2192 Orders \u2192 Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103899https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cd7c07-e119-4064-a7a9-08c81409f90a?source=cvehttps://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/integration/admin/orders_integration.php#L238https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/views/admin/order-vat-info-box.php#L173https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/order/order.php#L56https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/plugin-main.php#L901https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/plugin-main.php#L1655https://plugins.trac.wordpress.org/browser/woocommerce-eu-vat-assistant/tags/2.1.30.260413/src/lib/classes/integration/vat_number_validation/validators/vat_number_validator.php#L132#wordpress #daigo75 #EUVATAssistantforWooCommerce#CVE_2026_103899#bot", "url": "https://infosec.exchange/users/cve/statuses/117454207202663170"}, {"timestamp": "2026-10-17T04:02:33.178Z", "date_only": false, "value": "2026-10-17T04:02:33.178922Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my27guc5sx2z", "record": "CVE-2026-103899", "field": "creation_timestamp", "uuid": "33c72182-866b-49ea-a68b-40341f92db9d", "content": "CVE-2026-104736: LearnPress for WordPress has an unauthenticated PHP object injection flaw, a LearnPress authorization bypass (CVE-2026-107744) and a stored XSS in EU VAT Assistant for WooCommerce (CVE-2026-103899). No fixes stated; none confirmed exploited.", "url": "https://bsky.app/profile/suriq.io/post/3my27guc5sx2z"}, {"timestamp": "2026-10-17T04:16:47Z", "date_only": false, "value": "2026-10-17T04:16:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VJPH-8CF6-48HW", "record": "GHSA-VJPH-8CF6-48HW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-17T04:16:47.413Z", "date_only": false, "value": "2026-10-17T04:16:47.413", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103899", "record": "FKIE_CVE-2026-103899", "field": "published"}, {"timestamp": "2026-10-17T06:30:31Z", "date_only": false, "value": "2026-10-17T06:30:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VJPH-8CF6-48HW", "record": "GHSA-VJPH-8CF6-48HW", "field": "published"}, {"timestamp": "2026-10-17T06:30:31Z", "date_only": false, "value": "2026-10-17T06:30:31Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VJPH-8CF6-48HW", "record": "GHSA-VJPH-8CF6-48HW", "field": "modified"}, {"timestamp": "2026-10-17T10:31:23.636Z", "date_only": false, "value": "2026-10-17T10:31:23.636876Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3my2v66czol2x", "record": "CVE-2026-103899", "field": "creation_timestamp", "uuid": "3dd28a97-2c70-4c85-ada1-975bdf60d277", "content": "WooCommerce\u7528EU VAT\u30a2\u30b7\u30b9\u30bf\u30f3\u30c8\uff08v2.1.30.260413\u307e\u3067\uff09\u3067Stored XSS\u8106\u5f31\u6027\u3002\u7121\u8a8d\u8a3c\u653b\u6483\u8005\u304c\u7ba1\u7406\u753b\u9762\u3067\u306e\u6ce8\u6587\u7de8\u96c6\u6642\u306b\u30b9\u30af\u30ea\u30d7\u30c8\u5b9f\u884c\u53ef\u80fd\u3002\u7ba1\u7406\u8005\u6a29\u9650\u6607\u683c\u3084\u30b5\u30a4\u30c8\u4e57\u3063\u2026\nCVE-2026-103899 CVSS 7.2 | HIGH", "url": "https://bsky.app/profile/postac001.bsky.social/post/3my2v66czol2x"}, {"timestamp": "2026-10-17T11:07:30.118Z", "date_only": false, "value": "2026-10-17T11:07:30.118518Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3my2x6pj2ew27", "record": "CVE-2026-103899", "field": "creation_timestamp", "uuid": "641f4d6a-b2e3-45fd-98b7-0d514c0e26bf", "content": "CVE-2026-103899 - Stored XSS in EU VAT Assistant for WooCommerce. Allows unauthenticated script execution in admin context. CVSS 7.2. Audit orders now. #CVE #WordPress #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-103899/", "url": "https://bsky.app/profile/hugovalters.bsky.social/post/3my2x6pj2ew27"}, {"timestamp": "2026-10-18T11:06:57.510Z", "date_only": false, "value": "2026-10-18T11:06:57.510378Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103899", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-18T11:06:57.510Z", "date_only": false, "value": "2026-10-18T11:06:57.510378Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103899", "record": "FKIE_CVE-2026-103899", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-18T11:12:33.948Z", "date_only": false, "value": "2026-10-18T11:12:33.948Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103899", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-18T11:12:33.948Z", "date_only": false, "value": "2026-10-18T11:12:33.948Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103899", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T15:16:45.150Z", "date_only": false, "value": "2026-10-19T15:16:45.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103899", "record": "FKIE_CVE-2026-103899", "field": "lastModified"}]}