FiboSearch for WooCommerce CVE-2026-100106

Exploitation requires (1) an authenticated account at Subscriber level or above - practical on WooCommerce stores that permit open customer registration, but excludes anonymous attackers; and (2) a specific non-default precondition stated in the description: the site owner must have previously completed the standard Freemius opt-in flow. Only once that opt-in is active can a Subscriber reach the vulnerable handler by loading /wp-admin/profile.php with the crafted 'purchased_plan' query parameters. The payload executes in the browser of any user who subsequently views the injected page, so impact depends on a privileged user (e.g., an administrator) visiting it. Installations that never completed the Freemius opt-in are not exploitable via this path, which meaningfully narrows the exposed population below the raw version-match count.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.4 (Medium) is driven by a scope change (S:C) typical of stored XSS, but every other signal tempers the urgency. The vector requires authenticated access (PR:L), and the description confirms this is subscriber-level - a low bar on sites with open registration (common for WooCommerce stores), but still a non-zero prerequisite that excludes fully unauthenticated attackers. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, exploitation is gated on a configuration precondition stated in the description - the site owner must have previously completed the Freemius opt-in flow - which means not all installations are exploitable in their default state. The signals are therefore consistent rather than conflicting: a real, reportable stored-XSS flaw (reported by Wordfence, patched in 1.34.3) with limited blast radius (C:L/I:L, admin-area execution) and meaningful preconditions. Prioritize as a routine patch-when-convenient item for sites allowing self-registration, not an urgent out-of-band response.

On a WooCommerce store that allows customer self-registration and whose owner has completed the FiboSearch/Freemius opt-in, an attacker registers a free Subscriber account and loads /wp-admin/profile.php with a malicious 'purchased_plan' query parameter, injecting a script payload that is stored and reflected without sanitization. The payload then executes in the browser of any user who views the affected admin page, potentially including an administrator, enabling session or action hijacking in the admin context. No public exploit code was identified in the provided data, and the network vector with low attack complexity (AV:N/AC:L) makes the request itself trivial to craft.