Stored Cross-Site Scripting in WPC Product Bundles for WooCommerce

CVE-2026-93836

What is CVE-2026-93836?

The WPC Product Bundles for WooCommerce plugin is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping of the 'qty' parameter. This vulnerability allows unauthenticated attackers to inject malicious web scripts that execute when a user accesses affected pages. The plugin's numeric validation for quantity input incorrectly allows payloads like '1' to bypass restrictions. These scripts are then stored in order item metadata, leading to potential exploitation and compromised user sessions.

References