CVE-2026-104926

Name of the Vulnerable Software and Affected Versions WooCommerce Extra Product Options Pro versions prior to 3.3.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs on product pages where a Date & Time Range Picker extra field is configured. Attackers can inject arbitrary web scripts via the <fieldname> start and <fieldname> end parameters, which execute if a user is tricked into clicking a malicious link. The required field name is visible in the product page source.

Recommendations Update to a version newer than 3.3.2.