Upsell Order Bump Offer for WooCommerce CVE-2026-116409

Exploitation requires an attacker to deliver a crafted request whose input the plugin reflects unsanitized back into a generated page, AND a victim must interact with that request (UI:R) for the payload to execute in their browser - the attacker cannot trigger it server-side alone. No authentication is required of the attacker (PR:N), so the crafting step is open to unauthenticated remote actors, but the dependence on victim interaction is the primary limiting factor and narrows realistic exploitation to social-engineering or lure-based delivery. The exact vulnerable parameter, endpoint, or feature is not described in the available sources. The flaw affects installations running the plugin at any version up to and including 3.1.6.

This is a reflected cross-site scripting flaw (CWE-79) in the WP Swings 'Upsell Order Bump Offer for WooCommerce' plugin, affecting all versions up to and including 3.1.6. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity issue that an unauthenticated attacker (PR:N) can attempt, but it explicitly requires victim interaction (UI:R) - the target must follow or render an attacker-crafted request - and the scope change (S:C) with Low C/I/A reflects that impact executes in the victim's browser context rather than directly compromising the server. No EPSS score was supplied, the vulnerability is not listed in CISA KEV, and no verified exploit code is referenced; the only reference is the Patchstack advisory entry itself, not a proof-of-concept. The vuln.today priority label is 'this_week', which positions this below emergency/act_now urgency but above routine. On balance this is a genuine but moderate-priority issue: reflected XSS is real and the low attack complexity helps the attacker, yet the mandatory user-interaction requirement and the browser-scoped (not server-scoped) impact keep it well short of a mass-exploitation, high-real-risk scenario. Missing data to note: no EPSS probability was provided, so widespread-exploitation likelihood cannot be quantified, and no fixed version is listed in the supplied evidence.

An attacker crafts a URL or form input containing a malicious script that the plugin reflects unsanitized into a generated web page, then lures a victim (such as a store administrator or shopper) into clicking the link. When the victim's browser renders the response, the script executes in their session context, enabling actions such as stealing session cookies or performing actions as the victim. No verified public exploit code is referenced - only the Patchstack advisory exists - and successful attack depends on the victim interacting with the crafted request (UI:R).