PT-2026-127818

CVE-2026-105972

Published

2026-10-28

Updated

2026-10-28

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Menu Cart for WooCommerce versions prior to 3.2.1

Description Insufficient input sanitization and output escaping of cart item variation data in the cart slide-out allows unauthenticated users to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are stored and subsequently executed in the session of another user, including logged-in administrators, when they access the affected page.

Recommendations Update to version 3.2.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers