Security Alert Summary
The WPC Product Bundles for WooCommerce plugin for WordPress is affected by a stored cross-site scripting (XSS) vulnerability in the handling of the qty parameter. An attacker can submit a specially crafted value that passes the plugin’s quantity validation and gets stored in order item metadata, causing scripts to run when a user views the affected page.
CVE Details
- CVE ID:
CVE-2026-93836 - Affected component: WPC Product Bundles for WooCommerce plugin for WordPress
- Affected versions: all versions up to and including 8.6.6
- Published: September 22, 2026 at 8:16:42 AM UTC
- Last modified: September 22, 2026 at 11:17:27 AM UTC
- CVSS v3.1 base score: 7.2
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impacts: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Cross-site Scripting)
Technical Details
According to the advisory description, the plugin fails to sufficiently sanitize input and escape output for the qty parameter. The vulnerability is a stored XSS: an attacker can submit a numeric-prefixed payload such as 1<img src=x onerror=...> which passes the plugin’s float cast quantity validation while retaining the malicious HTML. The payload is then stored verbatim in order item metadata under the _woosb_ids key. When an affected page renders that stored metadata, the injected script can execute in the context of users who view the page.
The issue exists because numeric validation allows values with a numeric prefix to pass while not stripping or escaping subsequent HTML content; stored data is written to item metadata without adequate escaping for output. The description does not name specific functions or REST endpoints beyond the metadata key under which data is stored.
How This Could Impact Your Website
In a typical small business WordPress site, multiple users interact with the store: the site owner, internal staff (for example store managers or editors), and external contractors or contributors who may update orders or view order pages. If an attacker stores a malicious payload via the affected qty parameter, any user who views the affected order or related page could have that script executed in their browser.
- Internal user data visible in the browser (for example names or email addresses displayed on order pages) could be exposed to the attacker or exfiltrated via the injected script, increasing the risk of targeted phishing or social engineering.
- Scripts that run in a viewer’s session could attempt to perform actions on behalf of that user within their permitted scope, leading to limited integrity impacts consistent with the CVSS assessment.
- Availability impacts are not indicated by the CVSS data for this vulnerability.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege roles that can access order pages or product settings.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, especially modifications to orders or metadata.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-backend.php#L1949
- https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-woosb.php#L1197
- https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-woosb.php#L579
- https://plugins.trac.wordpress.org/browser/woo-product-bundle/tags/8.6.5/includes/class-woosb.php#L584
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3702892%40woo-product-bundle&new=3702892%40woo-product-bundle
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fc620054-00ed-4c2e-9448-b40ae28efff3?source=cve
