WooCommerce Grid/List View Stored XSS via Shortcode Attribute (CVE-2026-15794)

Vulnerability Overview Vulnerability Name: Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute CVE ID: CVE-2026-15794 CVSS Score: 6.4 (Medium) Publication Date: July 22, 2026 Last Update Date: July 23, 2026 Researcher: Wordfence PRISM - Wordfence Scope of Impact Affected Versions: <= 3.0.9 Fixed Version: 3.0.9.1 Software Type: Plugin Software Name: Grid/List View for WooCommerce Patch Status: Yes Remediation Fix Method: Update to version 3.0.9.1 or later patched versions. Vulnerability Description The Grid/List View for WooCommerce plugin contains a stored cross-site scripting (XSS) vulnerability via the 'position' shortcode attribute. This vulnerability allows authenticated attackers (Contributor role and above) to inject arbitrary web scripts into pages, which are executed when users visit the affected pages. The shortcode’s attribute can be used to force the widget to render on pages, thereby expanding the attack surface beyond just shop and category pages. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Disclaimer: This record contains copyrighted material. Contact: For any errors or to request adding information, please contact . Recent Vulnerabilities Vulnerability Title: BeRocket Plugins <= (Various Versions) - Missing Authorization CVE ID: CVE-2022-45813 CVSS Score: 5.4 Researcher: István Márton Publication Date: December 13, 2022 Other Resources Wordfence Intelligence: Offers free personal and commercial API access to the WordPress vulnerability database. Wordfence WordPress Plugin: Immediately notifies you if your site is affected by new vulnerabilities. Documentation: Provides documentation on how to access and consume vulnerability data via the API. Contact Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Support: 24/7 support with a response time of 1 hour. Legal Notice Copyright: © 2012-2026 Defiant Inc. All Rights Reserved. Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Products and Services Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscription Stay Updated: Register to receive news and updates from experienced security professionals. Registration Sign Up: Checking this box indicates that I agree to the Terms of Service and Privacy Policy. Other Wordfence Intelligence: Completely free for personal and commercial use. API Documentation: Provides documentation on how to query vulnerability API endpoints and configure webhooks. Summary This page provides a detailed overview of a stored cross-site scripting (XSS) vulnerability in the Grid/List View for WooCommerce plugin, including a vulnerability summary, scope of impact, remediation steps, and related references and resources.

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Grid/List View Stored XSS via Shortcode Attribute (CVE-2026-15794)