---
id: "CVE-2026-88942"
kind: "vulnerability"
aliases: ["CVE-2026-88942"]
title: "WordPress WooCommerce product filter plugin: reflected cross-site scripting via wpf_fid"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wbw-product-filter", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-31T07:16:37+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:34:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88942", "first_seen_at": "2026-10-31T07:34:07+00:00"}]
---

# WordPress WooCommerce product filter plugin: reflected cross-site scripting via wpf_fid

The Product Filter for WooCommerce plugin by WBW fails to sanitize the wpf_fid parameter in JSON input, so a crafted link can inject scripts into a page. An attacker who tricks a visitor into clicking the link can run script in that visitor's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Product Filter for WooCommerce by WBW plugin in the WordPress admin plugins list; versions up to and including `3.4.6` are listed as affected.
- Note that the sources say the 3.4.3 patch is incomplete, so a site on `3.4.3` or later is still listed as affected.

## Fix

- Fixed version: unknown; the sources do not name a patched release.

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88942

## From the sources

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_