WooCommerce Product Feed Manager Reflected XSS in 's' Parameter (CVE-2026-15306)

Vulnerability Overview Vulnerability Name: Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter CVE ID: CVE-2026-15306 CVSS Score: 6.1 (Medium) Release Date: July 15, 2026 Last Updated: July 16, 2026 Researcher: PRISM - Wordfence Impact Scope Software Type: Plugin Software Slug: best-woocommerce-feed Affected Versions: <= 7.6.1 Fixed Version: 7.6.2 Remediation Fix: Update to version 7.6.2 or later patched version Additional Information Vulnerability Description: The Product Feed Manager For WooCommerce plugin contains a reflected cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts via the 's' search parameter, causing arbitrary scripts to execute when users click on links. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities Product Feed Manager <= 7.3.15 - Authenticated (Admin+) Directory Traversal - CVE ID: CVE-2023-52144 - CVSS Score: 2.7 - Researcher: Muhammad Daffa - Release Date: December 28, 2023 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update - CVE ID: Not Provided - CVSS Score: 8.8 - Researcher: Not Provided - Release Date: February 25, 2019 Notes This vulnerability database is completely free for personal and commercial use, containing all the same vulnerability data. API documentation and Webhook documentation are provided to facilitate querying the vulnerability API endpoints and configuring Webhooks. Contact Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Support: 365 days a year, 1-hour response time Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X Facebook LinkedIn Instagram Subscribe Subscribe to news and updates for insights from experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Subscribe to news and updates for insights from experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Subscribe to news and updates for insights from experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Subscribe to news and updates for insights from experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Subscribe to news and updates for insights from experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Subscribe to news and updates for insights from experienced security professionals. Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Other Products Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Product Feed Manager Reflected XSS in 's' Parameter (CVE-2026-15306)

More from this source