Reflected Cross-Site Scripting Vulnerability in WPC Smart Quick View Plugin by WordPress
CVE-2026-103888

6.1MEDIUM

Key Information:

Vendor: WordPress
Status: WPc Smart Quick View For WooCommerce
Vendor: CVE Published:; 3 October 2026

What is CVE-2026-103888?

The WPC Smart Quick View plugin for WooCommerce is susceptible to reflected cross-site scripting due to inadequate input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts into web pages. The exploitation requires the WooCommerce 'redirect to cart after add to cart' option to be enabled, and an attacker can have the script execute simply by persuading a user to access a specially-crafted URL without additional interaction. This can lead to unauthorized actions or data exposure for the user.

Affected Version(s)

WPC Smart Quick View for WooCommerce 0 <= 4.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/woo-smart-quic...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 3, 2026
Vulnerability Reserved
Oct 1, 2026

Credit

Kuba

CVE-2026-103888 Data

JSON