WooCommerce Menu Cart <= 3.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Product Variation Attribute Values
- ID
- WPSEC-2026-1276
- Plugin
- Menu Cart for WooCommerce (woocommerce-menu-bar-cart)
- Affected
- from 3.1.0 before 3.2.1
- Remediation
- Update to 3.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- WooCommerce Menu Cart on WPSec AttackSurface
- Fix released
- Published
Description
The Menu Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via product variation attribute values shown in the cart slide-out in all versions from 3.1.0 up to, and including, 3.2.0, due to insufficient output escaping. Cart item attribute labels and values are concatenated into the slide-out markup without escaping, and the markup returned in the WooCommerce cart fragments and the plugin's AJAX responses is not sanitized. This makes it possible for authenticated attackers with shop manager-level access and above to inject arbitrary web scripts that execute when a user who has added the affected product to their cart views a page with the menu cart slide-out.
References
- https://wpsec.com/vuln/WPSEC-2026-1276/
- https://plugins.svn.wordpress.org/woocommerce-menu-bar-cart/tags/3.2.1/
- https://wordpress.org/plugins/woocommerce-menu-bar-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS