CVE-2026-17162 is a stored XSS in WowStore versions 4.4.24 and earlier, affecting Gutenberg block attributes. The vulnerability lives in the 'currentPostId' attribute of WowStore blocks used in the WordPress block editor. CVSS 3.1 scores it 6.4 (Medium), but the actual attack surface is narrower than the number suggests—though not as narrow as the 0.00193 EPSS might imply.
The critical factor that changes the risk calculus: this payload executes on preview, not publication. When a contributor saves a draft or clicks 'Preview,' the block markup—including any injected JavaScript—renders immediately in the reviewing user's browser (typically an editor or administrator). The 'editorial review catches it' argument collapses here. The payload doesn't wait for publication to fire; it activates the moment a higher-privileged user opens the draft in the editor.
Contributor-level access is required, which limits the attacker to someone who already has a WordPress account with contributor permissions. That's not a trivial constraint in single-user installations, but it becomes meaningful in multi-author environments where contributor accounts are granted to contractors, guest writers, or team members with weaker credential hygiene. These accounts are also phishing targets—once compromised, the attacker already has the access needed to exploit this XSS.
What elevates this beyond baseline contributor-XSS is the WowStore context. This is a WooCommerce store builder, not a blog plugin. An admin session in a WooCommerce environment has access to order data, customer records, payment gateway configurations, and product inventory. The blast radius of session hijacking here extends significantly further than a typical WordPress stored XSS.
For defenders: verify you have WowStore version 4.4.25 or later. If you're on 4.4.24 or earlier, treat this as a patch-on-sight even at medium severity, because the preview-execution path means the vulnerability is active the moment a malicious draft exists on your site. Monitor contributor account creation and review your plugin ecosystem for other Gutenberg block plugins—this vulnerability class (block attribute XSS) is structurally likely to recur as the block editor ecosystem matures.