CVE-2026-116409
HighCVSS 7.1Summary
The Upsell Order Bump Offer for WooCommerce plugin by WP Swings contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.6.
Risk Assessment
An attacker can trick a user into clicking a crafted link and execute a script in the victim's browser within the site context, potentially leading to session theft or actions performed on behalf of the victim.
Recommendation
Update the Upsell Order Bump Offer for WooCommerce plugin to a version newer than 3.1.6. If no fix is available, consider disabling the plugin.
Other vulnerabilities in Upsell Order Bump Offer for WooCommerce
See all- CVE-2026-81288High
Unauthenticated XSS vulnerability in Upsell Order Bump Offer for WooCommerce versions up to 3.1.5. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2025-59565Medium
The Upsell Order Bump Offer for WooCommerce plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 3.0.7.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS