{"id":"CVE-2026-109988","aliases":["EUVD-2026-111604","GHSA-xqcg-xmfg-qf64"],"status":"published","title":"Product Addons for Woocommerce \u003c= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter","description":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00208,"percentile":0.10994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-28T06:45:17Z","modified":"2026-10-29T02:16:47Z","products":[{"vendor":"acowebs","product":"product addons for woocommerce – product options with custom fields"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c24e6f-396a-45bd-b16e-cb3b30aff25c?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/templates/cart/cart-item-data.php#L14"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/backend/api.php#L237"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/helper.php#L284"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/process/process.php#L262"},{"url":"https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/process/cart.php#L109"},{"url":"https://wordpress.org/plugins/woo-custom-product-addons/"},{"url":"https://plugins.trac.wordpress.org/changeset/3756829/woo-custom-product-addons/trunk/templates/cart/cart-item-data.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109988"},{"url":"https://wordpress.org/plugins/woo-custom-product-addons"},{"url":"https://github.com/advisories/GHSA-xqcg-xmfg-qf64"}],"sources":{"cve":[{"id":"CVE-2026-109988","title":"Product Addons for Woocommerce \u003c= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter","description":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-28T06:45:17.956Z","modified":"2026-10-29T01:41:51.709Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:11.581788Z"}],"euvd":[{"id":"EUVD-2026-111604","description":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-28T06:45:17Z","modified":"2026-10-29T01:41:51Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:18.489561Z"}],"ghsa":[{"id":"GHSA-xqcg-xmfg-qf64","title":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is...","description":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-28T09:31:54Z","modified":"2026-10-28T09:32:03Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:32.579072Z"}],"nvd":[{"id":"CVE-2026-109988","description":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-10-28T07:16:45.747Z","modified":"2026-10-29T02:16:47.803Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:04.037468Z"}]}}