CVE-2026-57422
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Bopo – WooCommerce Product Bundle Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 1.2.0.
Risk Assessment
An attacker can inject malicious JavaScript code into the page, potentially leading to session hijacking, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Bopo – WooCommerce Product Bundle Builder plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Bopo – WooCommerce Product Bundle Builder
See all- CVE-2026-110377Medium
The Bopo – WooCommerce Product Bundle Builder plugin (up to version 1.2.3) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthenticated users to access restricted functionality.
- CVE-2026-57664Medium
The vulnerability in the Bopo – WooCommerce Product Bundle Builder plugin version 1.1.6 and earlier allows unauthenticated attackers to access sensitive data. The flaw is due to insufficient protection of API endpoints or data exposure mechanisms.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through <= 1.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS