WooCommerce Product Addons CVE-2026-109988

Exploitation requires an authenticated account with WooCommerce shop manager-level access or above on a site running the Product Addons for Woocommerce - Product Options with Custom Fields plugin (versions ≤ 3.1.8). The specific injection point is the 'fields[section][fields][row][col][type]' parameter used when configuring product add-on fields; the stored payload executes when any user subsequently accesses a page that renders the injected add-on data. The main limiting factor is the high privilege requirement (PR:H) - shop manager is a trusted WooCommerce role - so this is realistically an insider, abused-account, or post-compromise escalation vector rather than remote unauthenticated exploitation; the trigger mechanism beyond insufficient sanitization/output escaping of this parameter is not further detailed in the available sources.

This is a low-to-moderate priority issue rather than an urgent one, and the signals are largely consistent. The input CVSS base score is 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N): network vector but high attack complexity, high privileges required (shop manager-level or above), and only limited confidentiality/integrity impact with a scope change reflecting script execution in the victim's browser context. It is NOT in CISA KEV (no active exploitation confirmed), no EPSS score was supplied, and the references are a Wordfence advisory plus WordPress plugin source-code/changeset links - there is no public exploit identified at time of analysis. The vuln.today Decision label is 'this_month', which aligns with a stored XSS gated behind a trusted, high-privilege WooCommerce role rather than an emergency. The chief mitigating factor is the PR:H requirement: an attacker must already hold shop manager or admin access, so this is primarily a privilege-boundary/insider or post-compromise concern, not a mass-exploitable internet-facing flaw. Missing data to note explicitly: no EPSS probability was provided, and no explicit fixed version is stated in the input (a trac changeset 3756829 is referenced, implying a patch, but the fixed release number is not given) - verify the fixed version with Acowebs/Wordfence before relying on an upgrade target.

An attacker who already holds a WooCommerce shop manager (or higher) account edits a product add-on configuration and injects a malicious script into the 'fields[section][fields][row][col][type]' parameter, which is stored without sufficient sanitization or output escaping. When another user - for example an administrator or a customer - later views the page rendering that add-on data, the stored script executes in their browser session. No public exploit code was identified at time of analysis.