EUVD-2026-43349Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote link-based reflected XSS needs victim interaction (UI:R) and no attacker auth (PR:N); script executing in the site context crosses scope (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo - WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo - WooCommerce Product Bundle Builder: from n/a through <= 1.2.0.
Articles & Coverage 1
AnalysisAI
Reflected cross-site scripting in the VillaTheme Bopo - WooCommerce Product Bundle Builder plugin for WordPress affects all versions up to and including 1.2.0, letting unauthenticated attackers inject script into a victim's browser session when the victim clicks a crafted link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects a scope change, meaning injected script executes in the WordPress site's security context and can target logged-in administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to have the Bopo - WooCommerce Product Bundle Builder plugin (version ≤ 1.2.0) installed and active, and requires the attacker to induce a victim to click a specially crafted URL - the CVSS UI:R metric confirms mandatory user interaction, which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.1 (High), driven by network attack vector, low complexity, no privileges required, but crucially requiring user interaction (UI:R) and yielding only limited (Low) confidentiality, integrity, and availability impact - offset upward by the changed scope (S:C) reflecting script execution in the site context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL to the target WooCommerce store containing a malicious script payload in a parameter handled by the plugin, then delivers it to a store administrator or customer via phishing email, forum post, or chat. When the victim clicks the link, the plugin reflects the payload unsanitized and the script executes in their browser under the site's origin, allowing session cookie theft, actions performed as the victim, or redirection. … |
| Remediation | Upgrade the Bopo - WooCommerce Product Bundle Builder plugin to a release later than 1.2.0 once VillaTheme publishes a fixed version; the input data lists affected versions only through 1.2.0 and does not include a confirmed fixed version, so this is best characterized as no vendor-released patched version independently confirmed at time of analysis - monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/bopo-woo-product-bundle-builder/vulnerability/wordpress-bopo-woocommerce-product-bundle-builder-plugin-1-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress.org plugin page for the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress instances for this plugin and disable or remove it if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today