Live › vulnerability › CVE-2026-116409
Upsell Order Bump Offer for WooCommerce, a WordPress plugin from WP Swings, has a reflected cross-site scripting flaw in versions up to and including 3.1.6. An attacker can craft a link that runs script in the browser of a user who opens it, such as a store admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Sites running the Upsell Order Bump Offer for WooCommerce plugin at version 3.1.6 or earlier. Reflected XSS needs a victim to open a crafted link, so exposure depends on whether the plugin's vulnerable endpoint reflects input on pages users visit. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/upsell-order-bump-offer-for-woocommerce/.upsell-order-bump-offer-for-woocommerce in your plugin list.3.1.6 (fixed version not stated in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-116409")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.