{"id":"CVE-2026-105150","kind":"vulnerability","aliases":["CVE-2026-105150"],"related":[],"title":"WooCommerce Product Filter plugin: reflected script injection via text_no_products parameter","description":"The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","summary":"The Product Filter for WooCommerce plugin by WBW does not sanitize the 'text_no_products' parameter, so a crafted link can inject scripts into a page. An attacker can run JavaScript in a visitor's browser if that visitor is tricked into clicking the link.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wbw-product-filter","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Product Filter for WooCommerce plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Look for the 'text_no_products' parameter in use on your site's filtered product pages\n- Versions up to and including `3.4.5` are affected according to the sources","fix":"- Move the plugin to a version later than `3.4.5`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-10T22:17:55+00:00","first_seen_at":"2026-11-10T22:27:23+00:00","triaged_at":"2026-11-10T22:29:19+00:00","updated_at":"2026-11-10T22:29:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T22:29:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move the plugin to a version later than `3.4.5`; the sources do not name the exact fixed version","reach":"internet","title":"WooCommerce Product Filter plugin: reflected script injection via text_no_products parameter","impact":"medium","summary":"The Product Filter for WooCommerce plugin by WBW does not sanitize the 'text_no_products' parameter, so a crafted link can inject scripts into a page. An attacker can run JavaScript in a visitor's browser if that visitor is tricked into clicking the link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wbw-product-filter"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs scripts in a visitor's browser on the store","analyst_note":"Confirm the first fixed version of the Product Filter for WooCommerce plugin by WBW from the NVD or WordPress plugin changelog.","how_to_check":"- Check the installed version of the Product Filter for WooCommerce plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug> --field=version`\n- Look for the 'text_no_products' parameter in use on your site's filtered product pages\n- Versions up to and including `3.4.5` are affected according to the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Product Filter for WooCommerce plugin by WBW at version 3.4.5 or earlier are exposed. The attack needs a visitor to click a crafted link, and the sources do not say whether any non-default setting is required. Sites without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000789,"input_tokens":4615,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105150':15A,18A '-2026':14A,17A '3.4.5':102C 'action':137C 'arbitrari':120C 'attack':53B,117C 'browser':61B 'click':68B,140C 'craft':44B 'cross':86C 'cross-sit':85C 'cve':13A,16A 'due':103C 'escap':110C 'execut':126C 'filter':3A,23B,28B,73C 'includ':101C 'inject':7A,47B,119C 'input':106C 'insuffici':105C 'javascript':56B 'link':45B,70B,143C 'make':112C 'output':109C 'packag':19B 'page':51B,124C 'paramet':12A,41B,94C 'perform':135C 'plugin':4A,31B,78C 'possibl':114C 'product':2A,11A,22B,27B,40B,72C,93C 'reflect':5A,84C 'run':55B 'sanit':36B,107C 'script':6A,48B,88C,122C 'site':87C 'success':130C 'text':9A,38B,91C 'trick':66B,131C 'unauthent':116C 'user':133C 'version':97C 'via':8A,89C 'visitor':59B,64B 'vulner':82C 'wbw':21B,33B,77C 'wbw-product-filt':20B 'web':121C 'woocommerc':1A,24B,30B,75C 'wordpress':25B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Product Filter for WooCommerce plugin by WBW at version 3.4.5 or earlier are exposed. The attack needs a visitor to click a crafted link, and the sources do not say whether any non-default setting is required. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wbwproductfilter","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-105150':15A,18A '-2026':14A,17A 'cve':13A,16A 'filter':3A 'inject':7A 'paramet':12A 'plugin':4A 'product':2A,11A 'reflect':5A 'script':6A 'text':9A 'via':8A 'woocommerc':1A","search_b":"'attack':53B 'browser':61B 'click':68B 'craft':44B 'filter':23B,28B 'inject':47B 'javascript':56B 'link':45B,70B 'packag':19B 'page':51B 'paramet':41B 'plugin':31B 'product':22B,27B,40B 'run':55B 'sanit':36B 'script':48B 'text':38B 'trick':66B 'visitor':59B,64B 'wbw':21B,33B 'wbw-product-filt':20B 'woocommerc':24B,30B 'wordpress':25B","search_c":"'3.4.5':102C 'action':137C 'arbitrari':120C 'attack':117C 'click':140C 'cross':86C 'cross-sit':85C 'due':103C 'escap':110C 'execut':126C 'filter':73C 'includ':101C 'inject':119C 'input':106C 'insuffici':105C 'link':143C 'make':112C 'output':109C 'page':124C 'paramet':94C 'perform':135C 'plugin':78C 'possibl':114C 'product':72C,93C 'reflect':84C 'sanit':107C 'script':88C,122C 'site':87C 'success':130C 'text':91C 'trick':131C 'unauthent':116C 'user':133C 'version':97C 'via':89C 'vulner':82C 'wbw':77C 'web':121C 'woocommerc':75C 'wordpress':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105150","severity":null,"published_at":"2026-11-10T22:17:55+00:00","modified_at":"2026-11-10T22:17:55+00:00","first_seen_at":"2026-11-10T22:27:23+00:00","fetched_at":"2026-11-10T22:27:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}