EUVD-2026-44863
GHSA-xw2w-9955-6f5w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring no privileges; UI:R because victim must click; S:C because script executes in victim's browser context outside plugin scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Product Feed Manager For WooCommerce - Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the Product Feed Manager For WooCommerce WordPress plugin (all versions through 7.6.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unescaped 's' search parameter, which executes in a victim's browser upon interaction with a crafted link. The vulnerability is rooted in insufficient sanitization and output escaping within the plugin's admin-facing PHP classes, as confirmed by Wordfence with direct source code references to class-rex-product-feed-actions.php and class-rex-product-feed.php. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) describes the root cause: user-controlled input from the HTTP GET parameter 's' (a search field) is reflected into HTML output without adequate sanitization or context-aware escaping. The vulnerability is localized to the plugin's admin action handler, specifically in class-rex-product-feed-actions.php at lines 740, 767, and 841, and class-rex-product-feed.php at line 241, as identified by the Wordfence source code references. The affected product is identified by CPE cpe:2.3:a:rextheme:product_feed_manager_for_woocommerce_-_sell_on_200+_online_marketplaces:*:*:*:*:*:*:*:*, developed by RexTheme for use within the WordPress/WooCommerce ecosystem. Because the vulnerability exists in admin-scoped PHP files, the injected script executes in an administrative browser context, enabling scope change (S:C) consistent with the CVSS vector.
RemediationAI
A code-level fix has been committed to the WordPress plugin repository SVN as changeset 3607243 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3607243%40best-woocommerce-feed&new=3607243%40best-woocommerce-feed), indicating upstream remediation is available; however, the exact released plugin version incorporating this fix is not independently confirmed from the provided data - users should update to the latest version available on WordPress.org and verify it is higher than 7.6.1. If an immediate update is not possible, a compensating control is to restrict access to the affected admin pages via server-side rules (e.g., Apache/nginx location blocks or a Web Application Firewall rule filtering reflected 's' parameter content containing script tags), though this introduces risk of blocking legitimate search functionality. Additionally, training privileged WordPress users to scrutinize URLs before clicking links from external sources reduces phishing exposure. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/10207866-6615-486b-a60a-a522ed8a0285 should be monitored for confirmed fixed-version disclosure.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today