CVE-2026-88942— Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter

Quick assessment

Affected

woobewoo Product Filter for WooCommerce by WBW

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"The Product Filter for WooCommerce by WBW"插件在所有 3.4.6 及更早版本中，存在通过"wpf_fid"JSON 参数引发的反射型跨站脚本（Reflected XSS）漏洞。该漏洞源于输入清理和输出转义不足，使得未认证的攻击者能够通过诱使用户执行特定操作（例如点击恶意链接），在页面中注入并执行任意 Web 脚本。值得注意的是，即使经过 3.4.3 补丁修复的版本仍存在此漏洞，原因是函数仅应用于的读取路径，而从 JSON 解码后的负载中读取的

CVSS 6.1 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
woobewoo	Product Filter for WooCommerce by WBW	0 ~ 3.4.6	-

II. Public POCs for CVE-2026-88942

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-88942

请登录查看更多情报信息。

Other References for CVE-2026-88942 (15)

https://www.cve.org/CVERecord?id=CVE-2026-88942

IV. Related Vulnerabilities

Same product: Product Filter for WooCommerce by WBW

Same vendor: woobewoo

Same weakness: CWE-79