Product Addons For Woocommerce Product Options With Custom Fields
Monthly
Stored cross-site scripting in the Product Addons for Woocommerce - Product Options with Custom Fields plugin (all versions up to and including 3.1.8) allows authenticated users with WooCommerce shop manager-level access or above to inject arbitrary script through the 'fields[section][fields][row][col][type]' parameter, which is then rendered without adequate escaping and executes for any user who later views a page containing the injected add-on data. The root cause is insufficient input sanitization combined with missing output escaping (CWE-79) across the plugin's field-handling code. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed risk is low-to-moderate because the PR:H prerequisite limits realistic abuse to trusted insiders, compromised shop-manager accounts, or post-compromise escalation rather than unauthenticated remote attack.
Stored cross-site scripting in the Product Addons for Woocommerce - Product Options with Custom Fields plugin (all versions up to and including 3.1.8) allows authenticated users with WooCommerce shop manager-level access or above to inject arbitrary script through the 'fields[section][fields][row][col][type]' parameter, which is then rendered without adequate escaping and executes for any user who later views a page containing the injected add-on data. The root cause is insufficient input sanitization combined with missing output escaping (CWE-79) across the plugin's field-handling code. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed risk is low-to-moderate because the PR:H prerequisite limits realistic abuse to trusted insiders, compromised shop-manager accounts, or post-compromise escalation rather than unauthenticated remote attack.