EUVD-2026-74601
GHSA-4pxf-9mg2-jcm5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify store pages rendering WBW filter widget
-
DeliveryCraft wpf_fid XSS payload URL
-
ExploitDeliver link to victim via phishing
-
ExecutionVictim clicks link, page reflects unsanitized parameter
-
PersistScript executes in victim browser under store domain
-
ImpactSteal admin session cookie or perform privileged store actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Three specific conditions must be met simultaneously: (1) the target WordPress site must have the WBW Product Filter plugin installed and active at version 3.4.2 or earlier; (2) the URL must point to a specific page that actively renders a product filter widget that triggers the vulnerable recalculation output - pages without this widget are not exploitable, limiting the attack surface to filter-enabled shop or category pages; (3) a victim user must click the attacker-crafted link (UI:R per CVSS). The attacker requires no authentication (PR:N). Exploitation is further limited by the social-engineering dependency: the payload does not persist in the database (unlike stored XSS), so it only affects users who follow the crafted link in the moment of delivery. |
| Impact | The CVSS 6.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately captures the risk profile: exploitation is low-complexity and requires no attacker authentication, but the mandatory user-interaction requirement (UI:R) and the precondition that the targeted page must actively render the vulnerable filter widget meaningfully narrow the real-world attack surface compared to stored XSS. No public exploit code is identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. EPSS data was not provided in the available intelligence. Despite the mid-tier base score, WooCommerce stores are frequently operated by merchants without dedicated security staff, and even a mid-sized municipal IT team in malbork running a community e-commerce site should treat this as worth patching promptly, since a successful attack could compromise authenticated administrator sessions and lead to store account takeover. No conflicting signals between data sources are present. |
| Exploit ScenarioDerived | An attacker identifies a WooCommerce store running the WBW Product Filter plugin in a vulnerable version and constructs a URL to a product listing page that renders the filter widget, appending a JavaScript payload in the 'wpf_fid' parameter. The attacker delivers the link to a store administrator via phishing email or a compromised third-party site. When the administrator clicks the link, the unsanitized parameter is reflected into the rendered page and the injected script executes in the admin's browser, capturing session cookies or performing privileged actions - such as creating rogue admin accounts - under the store's domain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. Successful exploitation requires social engineering - a victim must click a crafted URL targeting a store page where the plugin's filter recalculation output is rendered - enabling session hijacking, credential theft, or further escalation against authenticated users including store administrators.
RemediationAI
Update the Product Filter for WooCommerce by WBW plugin to version 3.4.3 or later - the ENISA EUVD boundary of affected versions at ≤3.4.2 implies 3.4.3 is the patched release, and a corresponding code changeset is available on the WordPress plugin Trac at https://plugins.trac.wordpress.org/changeset?reponame=&old=3686394%40woo-product-filter&new=3686394%40woo-product-filter. Note that the exact patched version number has not been independently confirmed from a formal release announcement - verify the installed version in the WordPress admin plugin panel after updating. If an immediate upgrade is not feasible, the most effective compensating control is to deactivate or remove the plugin on public-facing pages, which eliminates the vulnerable recalculation output endpoint entirely. Alternatively, deploying a WAF rule to filter script-injection patterns in the 'wpf_fid' parameter can block known exploitation attempts, though WAF rules require ongoing maintenance and may be bypassed by encoding variations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation) within the woobewoo plugin (CPE: cpe:2.3:a:woobewoo:product_filter_for_woocommerce_by_wbw:*:*:*:*:*:*:*:*). The plugin accepts the 'wpf_fid' filter ID parameter in HTTP requests and passes it without sanitization into recalculation output that is reflected directly into the page HTML. Wordfence's code references in the WordPress plugin Trac browser identify three specific loci: classes/req.php at line 57 (parameter ingestion), modules/woofilters/mod.php at line 3845 (processing), and modules/woofilters/views/woofilters.php at line 774 (rendered output). Because the injected payload executes in the victim's browser rather than on the server, the CVSS vector correctly records a scope change (S:C), consistent with how reflected XSS exploits the trust relationship between the victim's browser and the vulnerable domain.
Know when Product Filter For Woocommerce By Wbw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no attacker privileges (PR:N), mandatory victim interaction (UI:R), and browser-context scope change (S:C) with limited confidentiality/integrity impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
SQL injection in Product Filter for WooCommerce by WBW plugin versions below 3.1.3 allows unauthenticated remote attacke
The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to 3.1.2) contains a critical authentication
Reflected cross-site scripting in the Product Filter for WooCommerce by WBW WordPress plugin affects every release up to
WBW Product Filter for WooCommerce through version 3.4.6 lets unauthenticated remote attackers enumerate draft, future a
Exploit-DB