WPC Product Bundles CVE-2026-93836

Requires a WordPress site running WooCommerce with the WPC Product Bundles for WooCommerce plugin (version <=8.6.6) active and at least one bundle product available for ordering. The attacker needs no authentication and submits a numeric-prefixed payload (e.g. '1<img src=x onerror=...>') in the 'qty' parameter, which the plugin's float-cast quantity validation accepts while preserving the HTML; the payload is persisted in order item metadata under '_woosb_ids'. The limiting factor is that the stored script only executes when a user - realistically a privileged admin or shop manager - subsequently views the injected order/page in the WordPress dashboard, so impact is contingent on that victim view rather than firing automatically.

CVSS 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated stored XSS with a scope change (S:C) reflecting script execution in a different security context (the WordPress admin/store-manager viewing order data). No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - a real but not urgent priority. The most notable signal is the technical mechanism: the description explains a concrete validation-bypass (a float cast during quantity validation accepts a numeric-prefixed payload like '1<img src=x onerror=...>'), which is credible and specific rather than speculative. One tension to verify: the vector uses PR:N/UI:N, but the payload executes 'whenever a user accesses an injected page' - in practice execution typically requires a privileged user (e.g., admin/shop-manager) to open the affected order/page, which is an implicit user-interaction/victim step Wordfence's convention folds into stored-XSS scoring; defenders should treat effective exploitation as depending on a victim viewing injected content. Overall: a genuine unauthenticated stored-XSS worth patching promptly on affected sites, but absent EPSS/KEV/POC it is not evidence of active or widespread exploitation.

An unauthenticated attacker adds a bundle product to the cart and submits a crafted 'qty' value such as '1<img src=x onerror=alert(document.cookie)>'; the float cast during quantity validation accepts the numeric prefix while the HTML survives, and the raw payload is stored in the order item metadata under the '_woosb_ids' key. When a store administrator or shop manager later opens that order in wp-admin, the script executes in their authenticated browser session, enabling session/cookie theft or admin-context actions. No public exploit code was identified at time of analysis, though the description documents the bypass in enough detail to reproduce.