CVE-2026-104926 in WooCommerce Extra Product Options Pro Plugin
Summary
by MITRE • 10/31/2026
The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is only exploitable on product pages where a Date & Time Range Picker extra field is configured, though the required field name is visible in the product page source and requires no prior knowledge to discover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The WooCommerce Extra Product Options Pro plugin for WordPress contains a critical security flaw classified as Reflected Cross-Site Scripting within versions up to 3.3.2. This vulnerability stems from insufficient input sanitization and output escaping mechanisms when handling specific form parameters, namely the <fieldname>_start and <fieldname>_end fields associated with Date & Time Range Picker configurations. The core technical failure lies in the application's inability to properly validate or encode user-supplied data before rendering it back into the HTML response stream. When a malicious actor submits crafted input through these parameters, the web server reflects this untrusted data directly into the page content without applying necessary security filters such as HTML entity encoding or context-aware escaping. This allows an attacker to inject arbitrary JavaScript code that executes within the victim's browser session upon rendering of the affected product page.
The operational impact of this vulnerability is significant because it enables unauthenticated attackers to compromise user sessions and potentially steal sensitive information stored in cookies, local storage, or other client-side data stores. Since the attack vector relies on social engineering tactics such as tricking a user into clicking a malicious link containing the exploit payload, the success rate depends heavily on the target's interaction with the provided URL. However, the ease of exploitation is heightened by the fact that the required field names are visible in the source code of any product page utilizing the Date & Time Range Picker feature. This means attackers do not need prior knowledge or complex reconnaissance to identify valid parameter names; they can simply inspect the HTML structure of a target site and extract the necessary identifiers to construct functional exploit payloads.
From an industry standards perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of the flaw reflects CWE-601 URL Redirection to Untrusted Site which may lead to Open Redirect if combined with other factors, but primarily it represents a classic reflected XSS scenario where user input is not properly sanitized before being included in dynamic content generation. In terms of threat modeling and attack lifecycle mapping according to MITRE ATT&CK framework, this vulnerability facilitates the TA0001 Initial Access tactic through spearphishing link delivery mechanisms. It also supports subsequent techniques such as Credential Harvesting via browser-based capture or potentially Code Injection if further exploitation paths are discovered within the same context.
Mitigation strategies should focus on immediate remediation and long-term defensive posture improvements. The most effective solution is to upgrade the WooCommerce Extra Product Options Pro plugin to a version newer than 3.3.2 where these input validation issues have been addressed by the developers. For organizations unable to patch immediately, implementing Web Application Firewall rules that detect and block common XSS payloads in query parameters can provide temporary protection. Additionally, enforcing strict Content Security Policy headers with nonces or hashes for inline scripts can significantly reduce the impact of successful injection attempts by preventing unauthorized script execution even if the payload is delivered. Regular security audits focusing on input sanitization practices across all WordPress plugins are recommended to prevent similar vulnerabilities from arising in other components of the web application stack.