Live › vulnerability › CVE-2026-88942
The Product Filter for WooCommerce plugin by WBW fails to sanitize the wpf_fid parameter in JSON input, so a crafted link can inject scripts into a page. An attacker who tricks a visitor into clicking the link can run script in that visitor's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the Product Filter for WooCommerce by WBW plugin on WordPress, in all versions up to and including 3.4.6. The attack needs a victim to click a crafted link, and the sources describe no authentication requirement for the attacker. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
3.4.6 are listed as affected.3.4.3 or later is still listed as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.
This page as .md · .json · in your agent: get_signal("CVE-2026-88942")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.