Bopo Product Bundle Builder CVE-2026-57422

Exploitation requires the target WordPress site to have the Bopo - WooCommerce Product Bundle Builder plugin (version ≤ 1.2.0) installed and active, and requires the attacker to induce a victim to click a specially crafted URL - the CVSS UI:R metric confirms mandatory user interaction, which is the primary limiting factor. No authentication is needed by the attacker (PR:N), so any remote party can craft the malicious link, but the payload only executes in the context of whoever is socially engineered into visiting it; the value of the attack rises sharply if that victim is an authenticated administrator. Being reflected rather than stored, the payload is not persisted server-side and must be re-delivered to each victim, further limiting scale.

The CVSS 3.1 base score is 7.1 (High), driven by network attack vector, low complexity, no privileges required, but crucially requiring user interaction (UI:R) and yielding only limited (Low) confidentiality, integrity, and availability impact - offset upward by the changed scope (S:C) reflecting script execution in the site context. This is a realistic-but-not-critical priority: exploitation is not automatable at scale because it depends on socially engineering a specific victim into clicking a link, which is why reflected XSS typically carries a low EPSS probability (no EPSS value was provided in the input, so this is inferred from the vulnerability class). No KEV listing and no POC were provided, so there is no evidence of active or imminent exploitation. The signals are internally consistent - high reach but gated by user interaction - so no data conflicts require flagging, though the absence of EPSS and POC data means real-world exploitation likelihood is estimated from the class rather than confirmed.

An attacker crafts a URL to the target WooCommerce store containing a malicious script payload in a parameter handled by the plugin, then delivers it to a store administrator or customer via phishing email, forum post, or chat. When the victim clicks the link, the plugin reflects the payload unsanitized and the script executes in their browser under the site's origin, allowing session cookie theft, actions performed as the victim, or redirection. No public POC was provided, but the low attack complexity (AC:L) makes crafting such a link straightforward.