EUVD-2026-74601
GHSA-4pxf-9mg2-jcm5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no attacker privileges (PR:N), mandatory victim interaction (UI:R), and browser-context scope change (S:C) with limited confidentiality/integrity impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.
AnalysisAI
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must be met simultaneously: (1) the target WordPress site must have the WBW Product Filter plugin installed and active at version 3.4.2 or earlier; (2) the URL must point to a specific page that actively renders a product filter widget that triggers the vulnerable recalculation output - pages without this widget are not exploitable, limiting the attack surface to filter-enabled shop or category pages; (3) a victim user must click the attacker-crafted link (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately captures the risk profile: exploitation is low-complexity and requires no attacker authentication, but the mandatory user-interaction requirement (UI:R) and the precondition that the targeted page must actively render the vulnerable filter widget meaningfully narrow the real-world attack surface compared to stored XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Product Filter for WooCommerce by WBW plugin to version 3.4.3 or later - the ENISA EUVD boundary of affected versions at ≤3.4.2 implies 3.4.3 is the patched release, and a corresponding code changeset is available on the WordPress plugin Trac at https://plugins.trac.wordpress.org/changeset?reponame=&old=3686394%40woo-product-filter&new=3686394%40woo-product-filter. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in Product Filter for WooCommerce by WBW plugin versions below 3.1.3 allows unauthenticated remote attacke
The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to 3.1.2) contains a critical authentication
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today