EUVD-2026-114606
GHSA-gcmh-9x86-4rvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft link with malicious wpf_fid payload
-
DeliveryTrick store user into clicking
-
ExploitServer reflects unsanitized JSON value
-
ExecutionScript executes in victim's browser
-
ImpactHijack session or perform site actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Product Filter for WooCommerce by WBW plugin (versions up to and including 3.4.6, including sites that applied the incomplete 3.4.3 patch) be installed and active. The specific trigger is the 'wpf_fid' value read from the JSON-decoded filterSettings payload in the plugin's filter response path, which is never sanitized with absint() (only the separate getVar() read path was fixed), allowing arbitrary script injection that is reflected into the response. No authentication is required (PR:N). The key limiting factor is required user interaction (UI:R): because the flaw is reflected, not stored, an attacker must trick each individual victim into clicking a crafted link or loading a crafted request - there is no persistent, self-propagating payload. Impact is confined to the victim's browser session in the context of the targeted site. |
| Impact | This is a moderate-severity reflected Cross-Site Scripting flaw (CWE-79), rated CVSS 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The signals are internally consistent and point to a real-but-not-urgent issue rather than a high-CVSS/low-real-risk mislabel: the attack is network-based and needs no authentication (PR:N), but it is gated by required user interaction (UI:R) and is reflected rather than stored, so each victim must be individually lured - which materially caps mass-exploitation potential. No CISA KEV listing is present in the input, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from this data. The vuln.today decision label is 'this_month,' which aligns with a reflected XSS that is serious but not an emergency. One notable nuance raises the practical priority: the description states the 3.4.3 patch was incomplete - absint() was applied only to the getVar() read path, leaving the JSON-decoded filterSettings read path unsanitized - so sites that believed they were patched at 3.4.3 remain exposed through 3.4.6. Overall this warrants scheduled remediation within the current cycle, consistent with the 'this_month' label, not immediate emergency patching. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a URL (or a form/link that triggers the plugin's filter request) embedding a malicious script in the 'wpf_fid' value within the JSON filterSettings payload. The attacker emails or posts this link to a user of the target WooCommerce store; when the victim clicks it, the unsanitized value is reflected into the page and the script executes in their browser session. No public exploit was identified in the provided data, though the trigger mechanism is well-documented in the Wordfence advisory and the referenced source lines. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 31, 2026
Reflected cross-site scripting in the Product Filter for WooCommerce by WBW WordPress plugin affects every release up to and including 3.4.6, and notably still affects sites that applied the incomplete 3.4.3 patch. The 'wpf_fid' value taken from the JSON-decoded filterSettings payload reaches the plugin's filter response path without absint() sanitization - only the separate getVar() read path was hardened - so an unauthenticated attacker who convinces a victim to click a crafted link can execute arbitrary script in that victim's browser session on the targeted site. Exploitation is per-victim and requires user interaction (UI:R), there is no persistent payload, and no public exploit code or active exploitation has been identified at time of analysis (priority label: this_month, CVSS 6.1).
RemediationAI
The upstream fix is the Trac changeset 3757178 (https://plugins.trac.wordpress.org/changeset/3757178/woo-product-filter/trunk/classes/class-woobewoo-pf-response.php), which modifies classes/class-woobewoo-pf-response.php in trunk; this is an upstream commit rather than a confirmed tagged release, so a patched plugin version should be verified on the WordPress.org plugin page before relying on it. Operators who previously applied the 3.4.3 update must not treat that as remediation - the advisory states the flaw persists in 3.4.3-patched builds - and should update to a build that contains changeset 3757178 once it ships. No vendor-documented workaround appears in the available references, so where the plugin cannot be updated immediately, the only reliable compensating control is deactivating or removing the Product Filter for WooCommerce by WBW plugin, with the trade-off that all layered product filtering and the associated filter UI on WooCommerce shop pages stops working. Restricting or filtering requests that carry filterSettings payloads at the WAF or reverse-proxy layer was not validated by the vendor and would in any case be a partial control against a reflection that depends on tricking an individual user into following a crafted link.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-79 cross-site scripting flaw inside a WordPress plugin that extends WooCommerce with layered product filtering. The plugin accepts a serialized filterSettings payload, JSON-decodes it, and reads the 'wpf_fid' key for use in building the filter response; that value is reflected into the HTTP response without being cast to an integer, which is where the injected markup or script executes. The referenced source in the plugin's Trac repository points at classes/class-woobewoo-pf-response.php (line 82) and at several spots in modules/woofilters/class-woobewoo-pf-woofilters-controller.php (lines 359, 363, 513 and 739) plus classes/class-woobewoo-pf-frame.php (line 391), showing that the vulnerable read path is distinct from the getVar() path that the earlier 3.4.3 fix covered with absint(). Because the payload is reflected rather than stored, the CVSS scope change (S:C) reflects that script runs with the target site's origin and can act on behalf of the victim within that origin, while the confidentiality and integrity impacts are limited (C:L/I:L) and there is no availability impact. The trigger requires an attacker-supplied request carrying the crafted JSON payload and a victim who follows an attacker-controlled link or loads an attacker-crafted request.
Know when Product Filter For Woocommerce By Wbw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network reflected XSS triggered only when a victim clicks a crafted link, so PR:N/UI:R; script execution in the victim's browser crosses the document trust boundary (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
SQL injection in Product Filter for WooCommerce by WBW plugin versions below 3.1.3 allows unauthenticated remote attacke
The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to 3.1.2) contains a critical authentication
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthent
WBW Product Filter for WooCommerce through version 3.4.6 lets unauthenticated remote attackers enumerate draft, future a
Exploit-DB