CVE-2026-88942

Name of the Vulnerable Software and Affected Versions Product Filter for WooCommerce by WBW versions prior to 3.4.7

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link, enabling the execution of arbitrary web scripts. The issue is located in the wpf fid JSON parameter, specifically within the JSON-decoded filterSettings payload, where the value remains unsanitized.

Recommendations Update the plugin to a version newer than 3.4.6.