Description

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The float cast used during quantity validation allows a numeric-prefixed payload such as '1<img src=x onerror=...>' to pass validation while retaining its malicious HTML, which is then stored verbatim in order item metadata under the '_woosb_ids' key.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-22T08:16:42.907Z",
  "pubdate": "2026-09-22T08:16:42.907Z",
  "executiveSummary": "The WPC Product Bundles for WooCommerce plugin contains a critical Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 8.6.6.\nThe vulnerability stems from improper input validation and output encoding within the 'qty' parameter during the product bundle processing flow.\nAn unauthenticated attacker can exploit this flaw by injecting malicious JavaScript payloads into order item metadata, specifically the '_woosb_ids' key.\nSuccessful exploitation allows for the execution of arbitrary scripts in the browser of any user—including administrators—who views the compromised order data, leading to potential session hijacking, unauthorized administrative actions, or site-wide defacement.\nThe risk is severe as it requires no prior authentication or specialized privileges, permitting remote exploitation via publicly accessible endpoints.\nSecurity teams should prioritize updating the plugin or implementing strict input filtering to neutralize the attack vector.",
  "technicalDetails": "The vulnerability originates from a flawed input validation routine implemented on the 'qty' parameter. The plugin utilizes a float type casting mechanism intended to restrict quantity inputs to numeric values. However, PHP's weak typing and float conversion behavior allow for numeric-prefixed strings, such as '1<img src=x onerror=alert(1)>', to bypass validation filters successfully.\nFollowing the bypass of the initial type check, the malicious input is processed by the plugin and stored in the WordPress database as order metadata under the '_woosb_ids' key. Because the plugin performs insufficient output escaping when rendering this metadata in the WooCommerce order management interface, the stored HTML and JavaScript payloads are rendered as active content in the browser.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies a target WooCommerce product bundle. Second, the attacker crafts a POST request to the bundle processing endpoint, embedding a malicious script tag within the 'qty' parameter. Third, the application's float casting logic truncates the numeric portion and retains the subsequent malicious HTML string, which is then persisted into the database record for the order item. Finally, when a store administrator or privileged user navigates to the backend order view or any page displaying the injected metadata, the browser parses and executes the injected script.\nThe scope of impact is significant due to the nature of stored XSS, which grants the attacker persistence in the administrative dashboard. The injected code executes within the context of the victim's session, enabling the attacker to perform actions on behalf of the authenticated user, such as escalating privileges, modifying system configurations, or exfiltrating sensitive customer and order information. The absence of adequate sanitization functions, such as sanitize_text_field() or esc_html(), coupled with the failure to properly escape output in the administrative templates, leaves the plugin's data handling logic fundamentally insecure against injection-based attacks."
}