CVE-2026-15306

MediumCVSS 6.1

Published: 16/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' search parameter in all versions up to and including 7.6.1. This is due to insufficient input sanitization and output escaping.

Risk Assessment

An unauthenticated attacker can inject arbitrary web scripts that execute in a victim's browser if they trick the user into clicking a crafted link. This could lead to session hijacking, redirection to malicious sites, or theft of sensitive data.

Recommendation

Update the plugin to the latest available version immediately. If no update is available, temporarily disable the plugin or apply WAF rules to block malicious 's' parameters.

Other vulnerabilities in Product Feed Manager For WooCommerce

CVE-2026-15258High
The Product Feed Manager For WooCommerce WordPress plugin before version 7.6.1 does not properly sanitize and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

Original NVD description (English source)

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.