CVE-2026-97660

Name of the Vulnerable Software and Affected Versions WPC Product Options for WooCommerce versions prior to 4.0.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs when a malicious payload is embedded in a multipart Content-Disposition field name starting with wpcpo-. Because PHP's RFC1867 parser preserves these field names byte-for-byte, the payload is stored in order item meta. This can be exploited during guest checkout, enabling the execution of arbitrary web scripts when a user accesses the affected page.

Recommendations Update WPC Product Options for WooCommerce to version 4.0.6 or later.