Product Feed Manager CVE-2026-15306

The Product Feed Manager For WooCommerce plugin must be installed and active on the target WordPress site running a version at or below 7.6.1. The attacker does not require any account or authentication to construct the malicious URL (PR:N per CVSS vector). However, exploitation is limited by the mandatory requirement that a human victim actively clicks the crafted link (UI:R), making purely automated mass exploitation infeasible. The highest-impact exploitation path requires the clicking victim to be an authenticated WordPress administrator, since the vulnerable code resides in admin-scoped files - unauthenticated visitor sessions would yield significantly lower impact. No non-default plugin configuration or special feature toggle is indicated as a prerequisite beyond the plugin being installed.

The NVD-assigned CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects the key trade-off: the vulnerability is trivially exploitable over the network without authentication, but requires a victim to actively click a crafted link, limiting opportunistic mass exploitation. The scope change (S:C) elevates real-world risk because script execution occurs in the victim's browser - if the victim is a WordPress administrator, an attacker could steal session cookies, escalate to persistent admin access, or inject backdoors. No EPSS data was provided in the intelligence, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV, and no public exploit code has been confirmed. Practical risk is therefore contingent on successful phishing or social engineering of a privileged WordPress user - lower than a stored XSS or unauthenticated RCE, but meaningful given the administrative code paths involved.

An attacker identifies a WordPress site running the vulnerable Product Feed Manager plugin, crafts a URL containing a malicious JavaScript payload embedded in the 's' search parameter pointing to the plugin's admin search page, and delivers it to a site administrator via phishing email or social media. When the administrator clicks the link while authenticated, the unsanitized parameter is reflected back into the page HTML and the script executes in their browser, potentially exfiltrating the admin session cookie or performing unauthorized actions on the WordPress backend. No public proof-of-concept code has been confirmed, but reflected XSS of this class is routinely exploited in WordPress plugin campaigns.