Stored Cross-Site Scripting Vulnerability in WooCommerce Grid/List View Plugin

CVE-2026-15794

What is CVE-2026-15794?

The WooCommerce Grid/List View plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'position' shortcode attribute. This issue arises from inadequate input sanitization and output escaping mechanisms, impacting all versions up to and including 3.0.9. Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability to embed harmful web scripts into pages, which will execute when other users access those pages. The use of the all_page="1" attribute enables the widget to be rendered on any page, thereby increasing the potential attack surface beyond just the shop and category sections, creating a significant risk for users.

References