CVE-2026-88942mediumCWE-79

CVE-2026-88942: falha de média gravidade em woobewoo Product Filter for WooCommerce by WBW

Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Product Filter for WooCommerce by WBW

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.3%
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
woobewoo · Product Filter for WooCommerce by WBW
CVEs relacionadas — woobewoo Product Filter for WooCommerce by WBW

No mesmo produto, das mais perigosas para as menos.

CVE-2025-2317HIGHProduct Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend ParameterEPSS 0.5%CVE-2026-7804MEDIUMProduct Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' ParameterEPSS 0.5%CVE-2025-8416HIGHProduct Filter by WBW <= 2.9.7 - Unauthenticated SQL InjectionEPSS 0.4%CVE-2021-4444HIGHProduct Filter by WooBeWoo <= 1.4.9 - Missing AuthorizationEPSS 0.3%CVE-2025-11269MEDIUMProduct Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.3%CVE-2026-3138MEDIUMProduct Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLEEPSS 0.3%