Live › vulnerability › CVE-2026-105972
Go to dashboardThe Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise or escape cart item variation data shown in its cart slide-out. An unauthenticated visitor can store a script payload that runs in another user's browser, including a logged-in administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Menu Cart for WooCommerce plugin older than 3.2.1 that show the cart slide-out to visitors are exposed, since the payload is stored from an unauthenticated cart action. Sites without this plugin, or already on 3.2.1 or later, are not affected. The sources do not say whether any particular store configuration is required.
No product ranges from the sources yet.
wp plugin get menu-cart --field=version with WP-CLI.3.2.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-105972")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.