CVE-2026-105150
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' pa
CVSS
6.1
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 10 nov 2026 · Última mod.: 10 nov 2026 · CWE-79
Sin historial EPSS suficiente todavía.
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/classes/class-woobewoo-pf-frame.php#L388
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/classes/class-woobewoo-pf-req.php#L311
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/classes/class-woobewoo-pf-response.php#L82
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L363
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L601
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/3731161/woo-product-filter
- www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/e34f455b-936d-4af5-ac9e-ed30cfdc20be?source=cve
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1264985.4 MED—
———WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.5hCVE-2026-1264956.1 MED—
———MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.5hCVE-2026-671775.4 MED—
———Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17.8hCVE-2026-671754.6 MED—
———Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.8hCVE-2026-125878——
———Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection.
This issue affects N-central: before 26.4.1.8hCVE-2026-1233415.4 MED—
———Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.8h