What is the CVSS score of CVE-2026-59512?

CVE-2026-59512 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Product Enquiry for WooCommerce are affected by CVE-2026-59512?

The Product Enquiry for WooCommerce plugin (versions ≤2.2.34.43) contains a high-severity cross-site scripting vulnerability that allows unauthenticated remote attackers to inject malicious code into…

How to fix or mitigate CVE-2026-59512?

Within 24 hours, inventory all Product Enquiry for WooCommerce plugin installations running version 2.2.34.43 or earlier and disable the plugin if operationally feasible; if business-critical, restrict access to authenticated administrators only and enable detailed logging. Within 7 days, deploy Web Application Firewall rules to block cross-site scripting payloads targeting the plugin, implement Content Security Policy headers with restrictive script-src directives, and activate automated monitoring of Patchstack feeds for vendor security updates. Within 30 days, conduct a comprehensive audit of customer-facing forms using the plugin, review logs for exploitation attempts, and finalize an emergency patching plan for rapid deployment once the vendor releases a fix.

Product Enquiry for WooCommerce CVE-2026-59512

EUVD-2026-48185 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-jr2f-rwqm-8mmf

WordPress XSS Wordpress Plugin Product Enquiry For Woocommerce

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS needing victim interaction (PR:N/UI:R), scope change as script runs in site origin (S:C), low C/I in the browser; availability set N since XSS has no real availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:24 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Product Enquiry for WooCommerce WordPress plugin (versions <= 2.2.34.43) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they view attacker-influenced content. The flaw is exploitable without authentication but requires the victim to interact (e.g., visit a crafted link or page), and the CVSS scope-change metric reflects that injected script runs in the trusted site context. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue was reported through Patchstack.

Technical ContextAI

The affected component is Product Enquiry for WooCommerce (vendor pi_web_solution, CPE cpe:2.3:a:pi_web_solution:product_enquiry_for_woocommerce), a PHP plugin that extends WooCommerce/WordPress to let shoppers submit product enquiry or quotation requests. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input - most plausibly an enquiry/quotation form field - is reflected or stored into HTML output without proper output encoding or input sanitization. Because WordPress renders this within the site's own origin, injected script inherits the site's DOM and cookies, which aligns with the CVSS scope change (S:C) where the vulnerable plugin compromises the browser security context of the wider WordPress site.

RemediationAI

Update the Product Enquiry for WooCommerce plugin to the first release above 2.2.34.43 once available; the exact fixed version is not specified in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/enquiry-quotation-for-woocommerce/vulnerability/wordpress-product-enquiry-for-woocommerce-plugin-2-2-34-43-cross-site-scripting-xss-vulnerability) or the WordPress.org plugin page to confirm the patched build before deploying. If no fixed version is yet published, apply compensating controls: deploy a WAF or virtual-patch rule (Patchstack, Wordfence, or ModSecurity) to filter script payloads in enquiry/quotation form submissions, add a restrictive Content-Security-Policy header to limit inline script execution (trade-off: may break legitimate inline scripts and needs testing), and consider disabling or restricting the product enquiry form on public-facing pages until patched (trade-off: removes the enquiry feature for customers). After patching, review stored enquiry records for any previously injected payloads.