CVE-2025-59565
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Upsell Order Bump Offer for WooCommerce plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 3.0.7.
Risk Assessment
A malicious script stored in the database can execute in the browser of any user visiting the infected page, potentially leading to administrator account takeover. All sites running the vulnerable plugin version are at risk.
Recommendation
Update the Upsell Order Bump Offer for WooCommerce plugin to the latest version available from the vendor that does not contain the vulnerability. If updating is not possible, consider disabling the plugin until a fix is released.
Other vulnerabilities in Upsell Order Bump Offer for WooCommerce
See all- CVE-2026-116409High
The Upsell Order Bump Offer for WooCommerce plugin by WP Swings contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.6.
- CVE-2026-81288High
Unauthenticated XSS vulnerability in Upsell Order Bump Offer for WooCommerce versions up to 3.1.5. An attacker can inject a malicious script that executes in the victim's browser.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Stored XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through <= 3.0.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS