CVE-2026-13718: Unknown Tabs Responsive

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

Affected products

• Unknown Tabs Responsive: up to and including 2.5

Published 2026-10-02. Last modified 2026-10-02.