WooCommerce Extra Product Options Pro CVE-2026-104926

Exploitation requires a WooCommerce product page on which a Date & Time Range Picker extra field is configured - this is the exact feature prerequisite stated in the description, and it is a non-default/per-product condition that limits the attack surface to sites using that specific field type. The attacker needs no authentication (PR:N) and no prior knowledge, because the required field name is visible in the product page source. The key limiting factor is user interaction (UI:R): a victim must be tricked into clicking the crafted link or performing the triggering action, so the payload executes only in the browser of a user who follows the attacker's link. Impact is bounded to the victim's browser/session context (reflected XSS), not direct server compromise.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes a network-reachable, unauthenticated reflected XSS whose severity is capped by required user interaction (UI:R) and only Low confidentiality/integrity impact with no availability effect; the scope change (S:C) reflects script execution in the victim's browser context rather than server compromise. The vuln.today decision label is 'this_month' - meaningful but explicitly below act_now/emergency. KEV status is not present in the input, so there is no indication of active exploitation. EPSS is not provided, so exploitation probability cannot be quantified from this data. No PoC or exploit reference is supplied (the two references are the Wordfence threat-intel entry and the vendor product page, neither of which is exploit code), so there is no public exploit identified at time of analysis. The signals are therefore consistent rather than conflicting: a reporter-confirmed (Wordfence) reflected XSS of medium severity, gated by user interaction and by a specific non-default field configuration, with no evidence of real-world exploitation. Missing data to note explicitly: EPSS score absent, KEV absent, and no fixed version is listed in the supplied evidence - verify the patched release with the vendor (ThemeHigh).

An attacker crafts a URL for a WooCommerce product page that has a Date & Time Range Picker extra field, embedding a script payload in the '<fieldname>_start' or '<fieldname>_end' parameter, and the field name needed is readable directly from the product page source. The attacker then lures a logged-in user (e.g. a shopper or administrator) into clicking the link, and the unsanitized parameter is reflected into the page so the script executes in that user's browser session. No public exploit identified at time of analysis, so this is a plausible but not demonstrated-in-the-wild scenario.