{"id":"CVE-2026-105972","kind":"vulnerability","aliases":["CVE-2026-105972"],"related":[],"title":"Menu Cart for WooCommerce: stored XSS via cart variation data","description":"The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.","summary":"The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise or escape cart item variation data shown in its cart slide-out. An unauthenticated visitor can store a script payload that runs in another user's browser, including a logged-in administrator.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["menu-cart","package","woocommerce","wordpress"],"not_affected_if":["plugin-version-3.2.1-or-later"],"how_to_check":"- Check the installed Menu Cart for WooCommerce plugin version in the WordPress admin under Plugins, or run `wp plugin get menu-cart --field=version` with WP-CLI.\n- unknown for other checks","fix":"- Update the Menu Cart for WooCommerce plugin to `3.2.1` or later.\n- unknown for other actions","status":"open","published_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:53+00:00","updated_at":"2026-10-28T06:32:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Menu Cart for WooCommerce plugin to `3.2.1` or later.\n- unknown for other actions","reach":"internet","title":"Menu Cart for WooCommerce: stored XSS via cart variation data","impact":"medium","summary":"The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise or escape cart item variation data shown in its cart slide-out. An unauthenticated visitor can store a script payload that runs in another user's browser, including a logged-in administrator.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","menu-cart"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in an administrator's session on the site","analyst_note":"","how_to_check":"- Check the installed Menu Cart for WooCommerce plugin version in the WordPress admin under Plugins, or run `wp plugin get menu-cart --field=version` with WP-CLI.\n- unknown for other checks","needs_analyst":false,"not_affected_if":["plugin-version-3.2.1-or-later"],"who_is_affected":"Sites running the Menu Cart for WooCommerce plugin older than 3.2.1 that show the cart slide-out to visitors are exposed, since the payload is stored from an unauthenticated cart action. Sites without this plugin, or already on 3.2.1 or later, are not affected. The sources do not say whether any particular store configuration is required.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000609,"input_tokens":3327,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105972':13A,16A '-2026':12A,15A '3.2.1':31B,77C 'administr':68B,125C 'allow':96C 'anoth':59B,118C 'browser':62B 'cart':2A,8A,19B,25B,37B,44B,71C,83C,92C 'cross':103C 'cross-sit':102C 'cve':11A,14A 'data':10A,40B,86C 'deliv':110C 'escap':36B,82C 'execut':113C 'includ':63B,120C 'item':38B,84C 'log':66B,123C 'logged-in':65B,122C 'menu':1A,18B,24B,70C 'menu-cart':17B 'output':88C 'packag':20B 'payload':55B,106C 'plugin':29B,75C 'run':57B 'sanitis':34B,80C 'script':54B,105C 'session':116C 'shown':41B 'site':104C 'slide':46B,94C 'slide-out':45B,93C 'store':5A,52B,100C 'unauthent':49B,97C 'user':60B,98C,119C 'variat':9A,39B,85C 'via':7A 'visitor':50B 'woocommerc':4A,21B,27B,73C 'wordpress':22B,28B,74C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Menu Cart for WooCommerce plugin older than 3.2.1 that show the cart slide-out to visitors are exposed, since the payload is stored from an unauthenticated cart action. Sites without this plugin, or already on 3.2.1 or later, are not affected. The sources do not say whether any particular store configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105972","severity":null,"published_at":"2026-10-28T06:16:32+00:00","modified_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}