Upsell Order Bump Offer CVE-2026-81288

No attacker authentication is required (CVSS PR:N), but the attack depends on a victim - ideally a WooCommerce store administrator or authenticated user - actively clicking a specially crafted link (CVSS UI:R). The vulnerability is constrained to WordPress installations running WooCommerce with the Upsell Order Bump Offer plugin at version 3.1.5 or earlier. The scope change (S:C) means the injected payload executes in the victim's browser origin, not in an isolated sandbox, broadening the post-exploitation surface. Exploitation is not possible without the victim's interaction; defenders should focus on user awareness of phishing links alongside patching.

The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a reflected XSS exploitable remotely with low complexity and no attacker authentication, tempered by the requirement for victim interaction. The scope change is the key risk amplifier - injected scripts execute in the victim's browser origin and can harvest session cookies or trigger authenticated WooCommerce admin operations. No EPSS score was provided, and the vulnerability is absent from CISA KEV, placing exploitation status as theoretical at time of analysis; however, even a mid-sized e-commerce operation in opole running WooCommerce should treat an unauthenticated XSS targeting store admins as a meaningful remediation priority given the value of WooCommerce administrator sessions. The reported A:L (availability low) metric in the provided CVSS vector is atypical for reflected XSS, which generally carries no direct availability impact - this metric may be an overstatement and is not reflected in the independent assessed vector.

An attacker crafts a URL containing a JavaScript payload embedded in a parameter rendered unsanitized by the plugin and delivers it to a WooCommerce store administrator via a phishing email or malicious redirect. When the admin clicks the link and the browser renders the plugin's response, the injected script executes within the store's authenticated session, enabling session token theft or unauthorized administrative actions such as modifying orders or store settings. No public exploit code has been identified, but the low-complexity, unauthenticated nature of the attack makes it accessible to any attacker with basic XSS knowledge.