Stored Cross-Site Scripting Vulnerability in WPC Product Options Plugin for WordPress

CVE-2026-97660

What is CVE-2026-97660?

The WPC Product Options for WooCommerce plugin for WordPress (versions up to and including 4.0.5) is prone to a Stored Cross-Site Scripting (XSS) vulnerability. Due to inadequate input sanitization and output escaping, adversaries can exploit the plugin through guest checkout features. By injecting malicious web scripts in the multipart Content-Disposition field name, specifically those beginning with 'wpcpo-', attackers can store their payloads in order item meta, leading to potential execution whenever a user accesses the affected pages. This form of attack leverages PHP's RFC1867 parser, which preserves and stores data byte-for-byte, enhancing the risk for unknowing users.

References