Menu Cart EUVD-2026-111701

Exploitation requires that the site runs the Menu Cart for WooCommerce plugin (which depends on WooCommerce) at a version before 3.2.1 and displays the vulnerable cart slide-out feature. An unauthenticated attacker can store the payload by supplying crafted cart item variation data, but execution is gated by user interaction (UI:R): a victim - ideally a logged-in administrator - must subsequently load a page that renders the cart slide-out containing the stored payload. The practical limiting factors are therefore the need for a privileged victim to view the affected UI element and the requirement that the plugin be installed and active; there is no authentication barrier on the storage step itself.

This is a stored (persistent) Cross-Site Scripting flaw (CWE-79) in the Menu Cart for WooCommerce plugin, rated CVSS 7.5 in the input with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The signals are moderate and somewhat conflicting. On the elevating side: the attack vector is network-based and storage is unauthenticated (PR:N), and the payload is specifically designed to reach a logged-in administrator's session, which is the worst-case target for a WordPress site. On the moderating side: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit was identified at the time of analysis, so this is not evidence of active or imminent widespread exploitation. The input CVSS rates C:H/I:H/A:H with S:U, which is aggressive for a reflected-in-browser XSS - the supplied vector does not explain how a scope-unchanged XSS yields High impact across all three dimensions, so that rating should be treated as the reporter's worst-case (admin-session compromise leading to site takeover) rather than a mechanically derived value. The AC:H in the input is also not explained by the description, which simply states the data is stored unsanitised; the trigger mechanism beyond 'view the cart slide-out' is not described in the available sources. The vendor-priority decision label is 'this_week', consistent with a patch-available, genuine-but-not-emergency admin-targeting XSS. Net: a real issue worth patching on a near-term (this week) cadence, not a drop-everything emergency, but not a paper tiger either given the unauthenticated storage and administrator-targeting delivery.

An unauthenticated attacker submits crafted product variation data (e.g., via adding an item to the cart) containing a JavaScript payload that the plugin stores without sanitisation. When a victim - notably a logged-in administrator - later views the page containing the cart slide-out, the stored payload executes in their browser session, enabling session/cookie theft or actions performed as that administrator. No public exploit code was identified at time of analysis, though the issue was reported by WPScan and a vendor patch exists.