CVE-2026-15794

Name of the Vulnerable Software and Affected Versions Grid/List View for WooCommerce versions prior to 3.1.0

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the position shortcode attribute. These scripts execute when a user visits the affected page. Additionally, the all page="1" attribute can be used to force the widget to render on any page, increasing the potential attack surface beyond shop and category pages.

Recommendations Update Grid/List View for WooCommerce to version 3.1.0 or later.