Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Form Field Type
- ID
- WPSEC-2026-1384
- Plugin
- Product Addons for Woocommerce – Product Options with Custom Fields (woo-custom-product-addons)
- Affected
- all versions before 3.1.9
- Remediation
- Update to 3.1.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- Product Addons for Woocommerce – Product Options with Custom Fields on WPSec AttackSurface
- Fix released
- Published
Description
The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the field type of saved add-on forms in all versions up to, and including, 3.1.8, due to insufficient input sanitization and output escaping. The field type is saved without sanitization and printed unescaped into an HTML class attribute in the cart item meta template. This makes it possible for authenticated attackers with Shop Manager-level access and above to inject arbitrary web scripts that execute when a user views the cart or checkout page after adding a product that uses the form. This only matters on multisite installations and on installations where unfiltered_html has been disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1384/
- https://plugins.svn.wordpress.org/woo-custom-product-addons/tags/3.1.9/
- https://wordpress.org/plugins/woo-custom-product-addons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS