EUVD-2026-44863
GHSA-xw2w-9955-6f5w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring no privileges; UI:R because victim must click; S:C because script executes in victim's browser context outside plugin scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Product Feed Manager For WooCommerce - Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting in the Product Feed Manager For WooCommerce WordPress plugin (all versions through 7.6.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unescaped 's' search parameter, which executes in a victim's browser upon interaction with a crafted link. The vulnerability is rooted in insufficient sanitization and output escaping within the plugin's admin-facing PHP classes, as confirmed by Wordfence with direct source code references to class-rex-product-feed-actions.php and class-rex-product-feed.php. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Product Feed Manager For WooCommerce plugin must be installed and active on the target WordPress site running a version at or below 7.6.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects the key trade-off: the vulnerability is trivially exploitable over the network without authentication, but requires a victim to actively click a crafted link, limiting opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running the vulnerable Product Feed Manager plugin, crafts a URL containing a malicious JavaScript payload embedded in the 's' search parameter pointing to the plugin's admin search page, and delivers it to a site administrator via phishing email or social media. When the administrator clicks the link while authenticated, the unsanitized parameter is reflected back into the page HTML and the script executes in their browser, potentially exfiltrating the admin session cookie or performing unauthorized actions on the WordPress backend. … |
| Remediation | A code-level fix has been committed to the WordPress plugin repository SVN as changeset 3607243 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3607243%40best-woocommerce-feed&new=3607243%40best-woocommerce-feed), indicating upstream remediation is available; however, the exact released plugin version incorporating this fix is not independently confirmed from the provided data - users should update to the latest version available on WordPress.org and verify it is higher than 7.6.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today