Reflected Cross-Site Scripting Vulnerability in WooCommerce Product Filter by WBW Plugin

CVE-2026-88942

What is CVE-2026-88942?

The Product Filter for WooCommerce plugin by WBW is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping in the handling of the 'wpf_fid' JSON parameter. This vulnerability affects all versions up to and including 3.4.6. Attackers may exploit this flaw to inject arbitrary web scripts into the site's pages, potentially tricking users into executing malicious scripts through deceptive links. Notably, the patch for version 3.4.3 did not adequately address all input methods, allowing the exploit to persist without full remediation.

References