Description

Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:12.530Z",
  "pubdate": "2026-09-02T12:17:12.530Z",
  "executiveSummary": "The Upsell Order Bump Offer for WooCommerce plugin, specifically versions 3.1.5 and below, is susceptible to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.\nThis security flaw arises from the improper sanitization and escaping of user-supplied input before rendering it within the web browser. The vulnerability enables unauthenticated remote attackers to inject and execute arbitrary JavaScript code within the context of a victim's session.\nSuccessful exploitation allows an attacker to bypass browser-based security controls, potentially leading to unauthorized actions performed on behalf of an authenticated administrator or customer.\nImpacts include session hijacking, unauthorized redirection to malicious websites, defacement, and the exfiltration of sensitive information such as authentication cookies or administrative tokens.\nThe vulnerability is accessible over the network without requiring any prior authentication, making it a critical risk factor for any WooCommerce installation utilizing the affected plugin versions. Exploitation is relatively straightforward, as it relies on convincing a target user to interact with a crafted URL containing malicious script payloads.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Upsell Order Bump Offer for WooCommerce plugin to implement adequate output encoding or input validation on parameters processed during the order bump display logic. By failing to sanitize specific HTTP request parameters, the plugin allows raw user input to be reflected directly into the HTML response body.\nThe vulnerability manifests when the plugin processes unsanitized input and renders it within the DOM without implementing proper Content Security Policy (CSP) or context-aware output escaping. This permits the injection of script tags or attribute-based JavaScript execution vectors.\nThe attack flow proceeds as follows: First, an attacker identifies a vulnerable parameter within the plugin's URL structure or request handling component. Second, the attacker crafts a malicious URL containing a JavaScript payload encoded within this parameter. Third, the attacker lures an unsuspecting user, such as a site administrator, to click the crafted link or performs an automated request injection.\nUpon interaction, the victim's browser interprets the injected payload as legitimate source code within the origin of the vulnerable WordPress site. This grants the injected script full access to the Document Object Model (DOM), browser storage, and the ability to execute unauthorized administrative actions via asynchronous requests (AJAX) or DOM manipulation.\nAs this is an unauthenticated vulnerability, no elevated privileges are required to initiate the attack. The target's browser executes the script in the context of their current session. If the target is an administrator, the attacker could potentially create new administrative accounts, modify plugin settings, or inject persistent backdoors into the theme or active plugins.\nFurthermore, the script can capture sensitive information such as Session IDs, CSRF tokens, or personal user data currently rendered on the page, exfiltrating this data to an attacker-controlled remote server. The technical exposure is global, as any site running version 3.1.5 or lower of the plugin is susceptible to this manipulation, regardless of local security hardening applied elsewhere, unless a Web Application Firewall (WAF) is configured to block malicious script patterns in request parameters."
}