WPC Product Options EUVD-2026-91952

Requires that the site runs WPC Product Options for WooCommerce ≤4.0.5 with WooCommerce guest checkout enabled and reachable, so an unauthenticated attacker can submit an order. The payload must be delivered as a multipart/form-data Content-Disposition field name beginning with the 'wpcpo-' prefix, relying on PHP's RFC1867 parser preserving the raw field name; it is stored into order item meta. Execution is deferred and conditional: an authenticated user (realistically a store administrator viewing the order in wp-admin) must open the affected page for the stored script to fire, which bounds real-world impact despite the unauthenticated injection step.

This is a legitimate priority for any site running the affected plugin, though not a top-tier emergency. The CVSS 7.2 (HIGH) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N is internally consistent with the description: a network-reachable, low-complexity, unauthenticated flaw whose scope changes (S:C) because the payload stored at guest checkout executes in a different security context - typically the WooCommerce admin's authenticated session when they view the order. The unauthenticated vector (PR:N) via guest checkout is the key risk multiplier, since it removes the usual barrier for stored XSS and makes it exploitable by any anonymous visitor. Mitigating the severity, impact is limited (C:L/I:L/A:N) to script execution in a victim's browser rather than direct server compromise, and execution depends on an authenticated user (most plausibly a store administrator) subsequently opening the poisoned order. No EPSS score was supplied, so exploitation probability cannot be quantified; it is not listed in CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code. The signals are not conflicting - they align on a real-but-moderate stored-XSS issue. The primary caveat: this was reported by Wordfence and the source code lines are cited, but no independent vendor (WPClever) advisory or confirmed patched version is present in the input, so remediation details should be verified with the vendor.

An anonymous attacker places a guest-checkout order on a WooCommerce store running the plugin, crafting the multipart form so a Content-Disposition field name begins with 'wpcpo-' and contains a JavaScript payload. PHP's RFC1867 multipart parser preserves the field name byte-for-byte, and the plugin stores it unsanitized into order item meta. When a store administrator later opens that order in wp-admin, the script executes in their authenticated session. No public exploit code is referenced in the available data.