Is CVE-2026-109988 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109988 being exploited in the wild.

How severe is CVE-2026-109988?

Medium severity, with a CVSS score of 4.4, published 28 October 2026.

Which products and versions are affected?

WooThemes Product Addons for Woocommerce – Product Options with Custom Fields up to and including 3.1.8.

Is there a fix for CVE-2026-109988?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109988 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109988?

Check whether you run WooThemes Product Addons for Woocommerce – Product Options with Custom Fields at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109988: Woocommerce Product Addons stored cross-site scripting in field type parameter

CVE-2026-109988 · Severity: medium · CVSS 4.4 · Published 2026-10-28

The Product Addons for Woocommerce plugin for WordPress allows shop managers and higher-privilege users to inject malicious scripts through product field configuration. When other users view pages with the injected fields, the scripts execute in their browsers, enabling account takeover, data theft, or malware distribution.

Vendors: WooThemes.

Quick answers

Is CVE-2026-109988 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109988 being exploited in the wild.
How severe is CVE-2026-109988?: Medium severity, with a CVSS score of 4.4, published 28 October 2026.
Which products and versions are affected?: WooThemes Product Addons for Woocommerce – Product Options with Custom Fields up to and including 3.1.8.
Is there a fix for CVE-2026-109988?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109988 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109988?: Check whether you run WooThemes Product Addons for Woocommerce – Product Options with Custom Fields at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored XSS vulnerability in the WordPress plugin affecting the 'fields[section][fields][row][col][type]' parameter. The vulnerability exists due to insufficient input sanitization and output escaping. Exploitation requires authenticated access with shop manager-level privileges or above, and any user viewing the injected page triggers the stored script execution.

Affected products

WooThemes Product Addons for Woocommerce – Product Options with Custom Fields up to and including 3.1.8

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.