CVE-2026-93836 in WPC Product Bundles for WooCommerce Plugin
Summary
by MITRE • 09/22/2026
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The float cast used during quantity validation allows a numeric-prefixed payload such as '1<img src=x onerror=...>' to pass validation while retaining its malicious HTML, which is then stored verbatim in order item metadata under the '_woosb_ids' key.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The WPC Product Bundles plugin for WooCommerce represents a significant attack surface within WordPress e-commerce environments due to a critical Stored Cross-Site Scripting vulnerability identified across all versions up to and including 8.6.6. This flaw stems from insufficient input sanitization and output escaping mechanisms, allowing unauthenticated attackers to inject arbitrary web scripts into the application's database. The specific vector of exploitation involves the 'qty' parameter during product bundle configuration or order processing workflows. Because the vulnerability is stored rather than reflected, the malicious payload persists in the system until manually removed, meaning that every user who views a page containing this data will trigger the execution of the injected script without any further interaction from the attacker.
The technical root cause lies in how the plugin handles quantity validation for product bundles. The code employs a float cast operation to validate the 'qty' parameter, which creates a logic flaw where numeric-prefixed payloads can bypass security checks designed to reject non-numeric input. For instance, an attacker can submit a value such as 1<script>alert(1)</script>. During processing, the system casts this string to a floating-point number for validation purposes, effectively stripping or ignoring the malicious HTML tags during the check phase. However, when storing the data in order item metadata under the '_woosb_ids' key, the original raw input is saved verbatim without proper escaping. This discrepancy between validation logic and storage behavior allows the malicious script to be persisted in the database while appearing valid as a quantity value.
The operational impact of this vulnerability extends beyond simple defacement or session hijacking for individual users. Since the payload is stored within order metadata, it can affect multiple stakeholders including store administrators viewing order details, customers checking their purchase history, and potentially automated systems processing orders if they parse these fields without sanitization. The execution context typically occurs in an administrative dashboard or customer account page where JavaScript has elevated privileges compared to standard product pages. This increases the severity of potential attacks such as credential theft via keyloggers, session cookie hijacking using document.cookie exfiltration scripts, or even drive-by downloads if combined with other vectors. Furthermore, because it requires no authentication, any visitor to the site can trigger this injection by interacting with bundle products, making widespread exploitation feasible and difficult to detect through standard access logs alone.
From a classification perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting (XSS). Specifically, it falls under the Stored XSS subtype where malicious scripts are permanently stored within target servers. In terms of adversary tactics, this maps to ATT&CK technique T1059 Command and Control via Application Layer Protocol or more specifically T1189 Drive-by Compromise if used for initial access, though primarily it serves as a persistence mechanism for further exploitation like Credential Access (T1078) or Collection (T1113). The lack of output escaping is the primary failure point that enables this chain of events.
Mitigation strategies must address both immediate remediation and long-term defensive coding practices. Administrators should immediately update the WPC Product Bundles plugin to version 8.6.7 or later, where these input validation and output escaping issues have been resolved by developers. For sites unable to patch instantly due to compatibility concerns with other plugins, temporary workarounds include implementing a Web Application Firewall rule that blocks requests containing script tags within quantity parameters or restricting access to order management pages until the update is applied. Developers integrating similar functionality should ensure strict type casting followed by rigorous output escaping using functions like wp_kses_post or esc_html before rendering any user-supplied data in HTML contexts. Additionally, adopting Content Security Policy headers can mitigate the impact of successful XSS attacks by restricting script execution sources and preventing inline script evaluation where possible.