CVE-2026-39727

MediumCVSS 6.5

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The WC Fields Factory plugin in versions up to and including 4.1.12 contains a Cross Site Scripting (XSS) vulnerability that allows a user with the Subscriber role to inject malicious script.

Risk Assessment

A Subscriber can execute an XSS attack, potentially leading to session theft, account takeover, or modification of content visible to other users.

Recommendation

Update the WC Fields Factory plugin to a version newer than 4.1.12 to fix the XSS vulnerability.

Other vulnerabilities in WC Fields Factory

CVE-2026-93508High
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS