CVE-2026-93836

Name of the Vulnerable Software and Affected Versions WPC Product Bundles for WooCommerce versions prior to 8.6.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue arises because a float cast used during quantity validation allows payloads with numeric prefixes, such as 1<img src=x onerror=...>, to bypass validation. This malicious HTML is then stored in the order item metadata under the woosb ids key via the qty parameter.

Recommendations Update WPC Product Bundles for WooCommerce to version 8.6.7 or later. Avoid using the qty parameter in a way that allows unvalidated input until the update is applied.