CVE-2026-88942
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Product Filter for WooCommerce by WBW plugin is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' JSON parameter in versions up to 3.4.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.
Risk Assessment
Potential execution of malicious JavaScript in the user's browser, which could lead to session or data theft. The risk applies to sites using the Product Filter for WooCommerce by WBW plugin.
Recommendation
Update the plugin to a version later than 3.4.6. If updating is not possible, consider disabling the plugin until a fix is released.
Other vulnerabilities in Product Filter for WooCommerce by WBW
See all- CVE-2026-11396Medium
The Product Filter for WooCommerce by WBW plugin is vulnerable to Missing Authorization / Information Disclosure in versions up to 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.
- CVE-2026-7804Medium
Reflected Cross-Site Scripting (XSS) vulnerability in the Product Filter for WooCommerce by WBW plugin for WordPress, all versions up to and including 3.4.2, due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts if a user clicks a crafted link.
Original NVD description (English source)
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS