CVE-2026-81288
HighCVSS 7.1Summary
Unauthenticated XSS vulnerability in Upsell Order Bump Offer for WooCommerce versions up to 3.1.5. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
Risk of data theft, session hijacking, or malware distribution.
Recommendation
Update the plugin to the latest version with the fix.
Other vulnerabilities in Upsell Order Bump Offer for WooCommerce
See all- CVE-2026-116409High
The Upsell Order Bump Offer for WooCommerce plugin by WP Swings contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 3.1.6.
- CVE-2025-59565Medium
The Upsell Order Bump Offer for WooCommerce plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 3.0.7.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS