{"id":"CVE-2026-125814","kind":"vulnerability","aliases":["CVE-2026-125814"],"related":[],"title":"Product Feed PRO for WooCommerce: cross-site scripting through web page tags","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Code Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.8.","summary":"Product Feed PRO for WooCommerce does not neutralize script-related HTML tags in a web page, so injected code can run in a visitor's browser. The affected versions are listed as n/a through 13.5.8.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","product-feed-pro","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Product Feed PRO for WooCommerce plugin version in the WordPress admin plugins list (slug `woo-product-feed-pro`).\n- Confirm the installed version against the affected range, which runs through `13.5.8`.","fix":null,"status":"open","published_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","triaged_at":"2026-11-13T13:48:05+00:00","updated_at":"2026-11-13T13:48:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T13:48:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Product Feed PRO for WooCommerce: cross-site scripting through web page tags","impact":"medium","summary":"Product Feed PRO for WooCommerce does not neutralize script-related HTML tags in a web page, so injected code can run in a visitor's browser. The affected versions are listed as n/a through 13.5.8.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","product-feed-pro"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the store","analyst_note":"Find the vendor advisory or the patched version for woo-product-feed-pro after 13.5.8 and the input that is reflected, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125814.","how_to_check":"- Check the installed Product Feed PRO for WooCommerce plugin version in the WordPress admin plugins list (slug `woo-product-feed-pro`).\n- Confirm the installed version against the affected range, which runs through `13.5.8`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Product Feed PRO for WooCommerce WordPress plugin at or below version 13.5.8 may be exposed. The description does not say which inputs or pages are involved, or whether logged-in access is needed. Sites that do not run this plugin can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4581,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125814':16A,19A '-2026':15A,18A '13.5.8':62B,105C 'affect':55B,96C 'allow':92C 'basic':75C 'browser':53B 'co':81C 'code':46B,93C 'cross':7A 'cross-sit':6A 'cve':14A,17A 'feed':2A,23B,28B,83C,90C,98C 'html':38B,69C 'improp':63C 'inject':45B 'injection.this':94C 'issu':95C 'list':58B 'n/a':60B,103C 'neutral':34B,64C 'packag':20B 'page':12A,43B,74C 'pro':3A,24B,29B,84C,91C,99C 'product':1A,22B,27B,82C,89C,97C 'product-feed-pro':21B 'relat':37B,68C 'run':48B 'rymera':79C 'script':9A,36B,67C 'script-rel':35B,66C 'site':8A 'tag':13A,39B,70C 'version':56B 'visitor':51B 'vulner':77C 'web':11A,42B,73C,80C 'woo':88C 'woo-product-feed-pro':87C 'woocommerc':5A,25B,31B,86C,101C 'wordpress':26B 'xss':76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Product Feed PRO for WooCommerce WordPress plugin at or below version 13.5.8 may be exposed. The description does not say which inputs or pages are involved, or whether logged-in access is needed. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","productfeedpro","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-125814':16A,19A '-2026':15A,18A 'cross':7A 'cross-sit':6A 'cve':14A,17A 'feed':2A 'page':12A 'pro':3A 'product':1A 'script':9A 'site':8A 'tag':13A 'web':11A 'woocommerc':5A","search_b":"'13.5.8':62B 'affect':55B 'browser':53B 'code':46B 'feed':23B,28B 'html':38B 'inject':45B 'list':58B 'n/a':60B 'neutral':34B 'packag':20B 'page':43B 'pro':24B,29B 'product':22B,27B 'product-feed-pro':21B 'relat':37B 'run':48B 'script':36B 'script-rel':35B 'tag':39B 'version':56B 'visitor':51B 'web':42B 'woocommerc':25B,31B 'wordpress':26B","search_c":"'13.5.8':105C 'affect':96C 'allow':92C 'basic':75C 'co':81C 'code':93C 'feed':83C,90C,98C 'html':69C 'improp':63C 'injection.this':94C 'issu':95C 'n/a':103C 'neutral':64C 'page':74C 'pro':84C,91C,99C 'product':82C,89C,97C 'relat':68C 'rymera':79C 'script':67C 'script-rel':66C 'tag':70C 'vulner':77C 'web':73C,80C 'woo':88C 'woo-product-feed-pro':87C 'woocommerc':86C,101C 'xss':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125814","severity":null,"published_at":"2026-11-13T13:18:21+00:00","modified_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","fetched_at":"2026-11-13T13:46:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}