Floristpress For Woo Customize Your Ecommerce Store For Your Florist
CVE-2026-1986
|
EUVD-2026-16084
MEDIUM
GHSA-g85c-6q3h-m8pv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The FloristPress for Woo - Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'noresults' parameter in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping on the user supplied 'noresults' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
A Reflected Cross-Site Scripting (XSS) vulnerability exists in FloristPress for Woo (BakkBone) plugin versions up to 7.8.2, where the 'noresults' parameter is insufficiently sanitized and escaped, allowing unauthenticated attackers to inject arbitrary JavaScript. An attacker can craft a malicious URL and trick users into clicking it, resulting in script execution within the victim's browser session with access to sensitive data and session tokens. The vulnerability requires user interaction (UI:R) but has a network attack vector with low complexity, and while no KEV or confirmed active exploitation data is available in the provided intelligence, Wordfence has documented the issue with references to vulnerable code locations.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting), a foundational web application security flaw. The affected product is FloristPress for Woo (CPE:2.3:a:bakkbone:floristpress_for_woo_-_customize_your_ecommerce_store_for_your_florist), a WordPress plugin that customizes eCommerce stores for florists. The specific vulnerability resides in the AJAX handler at src/core/ajax.php (line 1583 as referenced in the WordPress plugin repository), where user-supplied input from the 'noresults' parameter is reflected back into the HTTP response without proper sanitization using WordPress security functions like sanitize_text_field() or escaping output using esc_attr() or esc_html(). This failure allows an attacker-controlled payload to be interpreted as executable code by the browser DOM or JavaScript engines.
RemediationAI
Upgrade FloristPress for Woo to a patched version beyond 7.8.2 immediately; check the vendor's WordPress plugin page or BakkBone's official website for the latest available version, with reference to the Wordfence threat intelligence page at https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3b6fa6-1b58-40c2-8ec2-8a9211069f11?source=cve for patch details and version numbers. The underlying fix requires implementing proper input validation and output encoding for the 'noresults' parameter using WordPress sanitization functions (such as sanitize_text_field()) on input and escaping functions (such as esc_attr() or wp_kses_post()) on output. Until the plugin is patched, implement a Web Application Firewall (WAF) rule to block requests with suspicious script-like payloads in the 'noresults' parameter, and educate staff and customers to avoid clicking untrusted links to your website; additionally, monitor for signs of XSS exploitation (unusual JavaScript execution, session anomalies) in web server and WordPress security logs.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today