{
 "id": "WPSEC-2026-1276",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1276/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1276/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1276/index.md",
 "title": "WooCommerce Menu Cart <= 3.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Product Variation Attribute Values",
 "description": "The Menu Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via product variation attribute values shown in the cart slide-out in all versions from 3.1.0 up to, and including, 3.2.0, due to insufficient output escaping. Cart item attribute labels and values are concatenated into the slide-out markup without escaping, and the markup returned in the WooCommerce cart fragments and the plugin's AJAX responses is not sanitized. This makes it possible for authenticated attackers with shop manager-level access and above to inject arbitrary web scripts that execute when a user who has added the affected product to their cart views a page with the menu cart slide-out.",
 "plugin": {
  "slug": "woocommerce-menu-bar-cart",
  "name": "WooCommerce Menu Cart",
  "full_name": "Menu Cart for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-menu-bar-cart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-menu-bar-cart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-menu-bar-cart"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.1.0",
    "from_inclusive": true,
    "to": "3.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.1.0 before 3.2.1"
  ]
 },
 "introduced_in": "3.1.0",
 "fixed_in": "3.2.1",
 "remediation": "Update to 3.2.1 or later.",
 "fix_released": "2026-10-19T09:32:59+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:03.144961+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1276/",
  "https://plugins.svn.wordpress.org/woocommerce-menu-bar-cart/tags/3.2.1/",
  "https://wordpress.org/plugins/woocommerce-menu-bar-cart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-menu-bar-cart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}