CVE-2026-88942mediumCWE-79

CVE-2026-88942: fallo de gravedad media en woobewoo Product Filter for WooCommerce by WBW

Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Product Filter for WooCommerce by WBW

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.3%
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
woobewoo · Product Filter for WooCommerce by WBW
CVEs relacionadas — woobewoo Product Filter for WooCommerce by WBW

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2317HIGHProduct Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend ParameterEPSS 0.5%CVE-2026-7804MEDIUMProduct Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' ParameterEPSS 0.5%CVE-2025-8416HIGHProduct Filter by WBW <= 2.9.7 - Unauthenticated SQL InjectionEPSS 0.4%CVE-2021-4444HIGHProduct Filter by WooBeWoo <= 1.4.9 - Missing AuthorizationEPSS 0.3%CVE-2025-11269MEDIUMProduct Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.3%CVE-2026-3138MEDIUMProduct Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLEEPSS 0.3%