EUVD-2026-84310
GHSA-m435-6crg-xq92
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network injection (PR:N) but the stored payload fires only when a privileged user views the order (UI:R); scope changes to the admin browser context (S:C) with limited confidentiality/integrity and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The float cast used during quantity validation allows a numeric-prefixed payload such as '1<img src=x onerror=...>' to pass validation while retaining its malicious HTML, which is then stored verbatim in order item metadata under the '_woosb_ids' key.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in WPC Product Bundles for WooCommerce, in all versions up to and including 8.6.6, allows an unauthenticated attacker to inject arbitrary JavaScript through the 'qty' parameter that is then persisted in order item metadata under the '_woosb_ids' key. Because the plugin casts the quantity to a float during validation, a numeric-prefixed payload such as '1<img src=x onerror=...>' passes the check while retaining its malicious HTML, which is stored verbatim and executes when a WordPress administrator or shop manager later opens the affected order record. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a WordPress site running WooCommerce with the WPC Product Bundles for WooCommerce plugin (version <=8.6.6) active and at least one bundle product available for ordering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated stored XSS with a scope change (S:C) reflecting script execution in a different security context (the WordPress admin/store-manager viewing order data). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade WPC Product Bundles for WooCommerce beyond version 8.6.6: an upstream fix for the quantity handling and '_woosb_ids' storage path is recorded in the plugin's Trac changeset 3702892 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3702892%40woo-product-bundle&new=3702892%40woo-product-bundle), but a tagged patched release is not independently confirmed in the available data, so administrators should verify the plugin changelog and install the first release that explicitly states the fix, monitoring the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fc620054-00ed-4c2e-9448-b40ae28efff3?source=cve for confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable the WPC Product Bundles for WooCommerce plugin if it is not business-critical, or deploy virtual patching via a Web Application Firewall (WAF) to block malicious 'qty' parameter payloads containing HTML/JavaScript. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today