CVE-2026-7804 in Product Filter for WooCommerce Plugin
Summary
by MITRE • 09/09/2026
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The Product Filter for WooCommerce plugin, developed by WBW, contains a critical security flaw identified as a Reflected Cross-Site Scripting vulnerability affecting all versions up to and including 3.4.2. This weakness stems from insufficient input sanitization and the absence of proper output escaping when handling the wpf_fid parameter within HTTP requests. The core technical issue lies in the plugin's failure to validate or encode user-supplied data before it is reflected back into the HTML response, allowing malicious scripts to be embedded directly into the page content served by the WordPress site. This specific implementation flaw aligns with CWE-79, which classifies improper neutralization of input during web page generation as a primary category for cross-site scripting vulnerabilities.
The operational impact of this vulnerability is significant because it enables unauthenticated attackers to execute arbitrary JavaScript code in the context of the victim's browser session. Since the exploitation does not require authentication, any internet user can attempt to craft malicious requests targeting pages that utilize the vulnerable product filter functionality with recalculation output enabled. The attack vector relies on social engineering tactics where an attacker must trick a legitimate site visitor into clicking a specially crafted link or submitting a form containing the injected script payload. Once executed, the malicious code runs within the trusted domain of the WordPress installation, potentially allowing attackers to steal session cookies, hijack user sessions, perform actions on behalf of the victim, or redirect users to phishing sites.
From an offensive security perspective, this vulnerability maps directly to the MITRE ATT&CK technique T1059.007, which covers JavaScript execution via browser-side scripting. The reflected nature of the XSS means that persistent storage is not required for initial exploitation, making it a rapid and effective method for delivering payloads such as keyloggers or credential harvesters. However, successful exploitation is contingent upon the target page actively using the product filter feature with recalculation output enabled, which limits the scope slightly but does not diminish the severity given the widespread use of WooCommerce in e-commerce environments.
To mitigate this risk, immediate action should be taken by updating the Product Filter for WooCommerce plugin to a version newer than 3.4.2 where these sanitization and escaping issues have been addressed by the developers. Administrators who cannot immediately update due to compatibility concerns should implement web application firewall rules that detect and block common XSS payload patterns within the wpf_fid parameter in HTTP requests. Additionally, ensuring that Content Security Policy headers are configured correctly can help mitigate the impact of any successful injection attempts by restricting the sources from which scripts can be loaded or executed. Regular security audits and code reviews focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities in future updates or custom integrations involving WooCommerce data handling.