{"id":"CVE-2026-88942","kind":"vulnerability","aliases":["CVE-2026-88942"],"related":[],"title":"WordPress WooCommerce product filter plugin: reflected cross-site scripting via wpf_fid","description":"The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.","summary":"The Product Filter for WooCommerce plugin by WBW fails to sanitize the wpf_fid parameter in JSON input, so a crafted link can inject scripts into a page. An attacker who tricks a visitor into clicking the link can run script in that visitor's browser session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wbw-product-filter","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Product Filter for WooCommerce by WBW plugin in the WordPress admin plugins list; versions up to and including `3.4.6` are listed as affected.\n- Note that the sources say the 3.4.3 patch is incomplete, so a site on `3.4.3` or later is still listed as affected.","fix":"- Fixed version: unknown; the sources do not name a patched release.","status":"open","published_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:43+00:00","updated_at":"2026-10-31T07:34:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:43Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown; the sources do not name a patched release.","reach":"internet","title":"WordPress WooCommerce product filter plugin: reflected cross-site scripting via wpf_fid","impact":"medium","summary":"The Product Filter for WooCommerce plugin by WBW fails to sanitize the wpf_fid parameter in JSON input, so a crafted link can inject scripts into a page. An attacker who tricks a visitor into clicking the link can run script in that visitor's browser session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wbw-product-filter"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in visitors' browsers, enabling session theft or actions","analyst_note":"Check the NVD entry or the WordPress plugin changelog for a patched version newer than 3.4.6, since the sources do not name one.","how_to_check":"- Check the installed version of the Product Filter for WooCommerce by WBW plugin in the WordPress admin plugins list; versions up to and including `3.4.6` are listed as affected.\n- Note that the sources say the 3.4.3 patch is incomplete, so a site on `3.4.3` or later is still listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Product Filter for WooCommerce by WBW plugin on WordPress, in all versions up to and including 3.4.6. The attack needs a victim to click a crafted link, and the sources describe no authentication requirement for the attacker. Sites that do not run this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4268,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-88942':16A,19A '3.4.3':154C '3.4.6':104C 'absint':157C 'action':139C 'appli':159C 'arbitrari':122C 'attack':56B,119C 'browser':72B 'click':62B,142C 'craft':47B 'cross':8A,89C 'cross-sit':7A,88C 'cve':14A,17A 'decod':176C 'due':105C 'entir':179C 'escap':112C 'execut':128C 'fail':35B 'fid':13A,40B,94C,169C 'filter':4A,24B,29B,76C 'filterset':177C 'getvar':163C 'includ':103C 'inject':50B,121C 'input':44B,108C 'insuffici':107C 'json':43B,95C,175C 'json-decod':174C 'leav':166C 'link':48B,64B,145C 'make':114C 'output':111C 'packag':20B 'page':54B,126C 'paramet':41B,96C 'patch':155C 'path':165C 'payload':178C 'perform':137C 'persist':148C 'plugin':5A,32B,81C 'possibl':116C 'product':3A,23B,28B,75C 'read':164C,171C 'receiv':152C 'reflect':6A,87C 'run':66B 'sanit':37B,109C 'script':10A,51B,67B,91C,124C 'session':73B 'site':9A,90C 'success':132C 'trick':58B,133C 'unauthent':118C 'unsanit':180C 'user':135C 'valu':170C 'version':99C,150C 'via':11A,92C 'visitor':60B,70B 'vulner':85C,147C 'wbw':22B,34B,80C 'wbw-product-filt':21B 'web':123C 'woocommerc':2A,25B,31B,78C 'wordpress':1A,26B,83C 'wpf':12A,39B,93C,168C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Product Filter for WooCommerce by WBW plugin on WordPress, in all versions up to and including 3.4.6. The attack needs a victim to click a crafted link, and the sources describe no authentication requirement for the attacker. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88942","severity":null,"published_at":"2026-10-31T07:16:37+00:00","modified_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}