Wpc Product Options For Woocommerce
Monthly
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Unauthenticated arbitrary file download in the WPC Product Options for WooCommerce WordPress plugin (versions ≤ 3.2.1) allows remote attackers to retrieve arbitrary files from the underlying server without any credentials. The flaw is a classic path traversal (CWE-22) reachable over the network at low complexity, and while no public exploit identified at time of analysis, the disclosure by Patchstack and trivial attack profile make opportunistic scanning likely against WooCommerce storefronts running this plugin.
Stored cross-site scripting in WPC Product Options for WooCommerce 4.0.5 and earlier allows unauthenticated attackers to inject arbitrary JavaScript into WooCommerce order item meta and have it execute in a store administrator's browser session. The injection happens through a guest-checkout path where the malicious payload is placed inside a multipart/form-data Content-Disposition field name prefixed with 'wpcpo-', a technique that bypasses the plugin's sanitization because PHP's RFC1867 parser preserves raw field names byte-for-byte; the script then fires when a privileged user (realistically an admin reviewing the order in wp-admin) opens the affected page. At CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and with authentication requirements confirmed as unauthenticated (PR:N) by the vector, the injection step is easy to reach on any shop with guest checkout enabled, but the deferred, victim-triggered execution and the need for an admin to view the poisoned order bound the practical impact; no public exploit code was identified at time of analysis and there is no CISA KEV entry.
Unauthenticated arbitrary file download in the WPC Product Options for WooCommerce WordPress plugin (versions ≤ 3.2.1) allows remote attackers to retrieve arbitrary files from the underlying server without any credentials. The flaw is a classic path traversal (CWE-22) reachable over the network at low complexity, and while no public exploit identified at time of analysis, the disclosure by Patchstack and trivial attack profile make opportunistic scanning likely against WooCommerce storefronts running this plugin.