Is CVE-2026-57422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57422 being exploited in the wild.

How severe is CVE-2026-57422?

High severity, with a CVSS score of 7.1, published 13 July 2026.

Is there a fix for CVE-2026-57422?

A patch was published on 2026-07-08: Version 1.2.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57422 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57422?

Check whether you run VillaTheme Bopo – WooCommerce Product Bundle Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57422: VillaTheme Bopo Reflected XSS in WooCommerce Product Bundle Builder

CVE-2026-57422 · Severity: high · CVSS 7.1 · Published 2026-07-13

VillaTheme Bopo is a WordPress plugin used by e-commerce sites to allow customers to build custom product bundles. A security flaw in this plugin allows attackers to trick a site administrator or visitor into clicking a malicious link, which then executes unauthorized code in their browser. This can lead to the theft of session cookies, unauthorized actions performed on behalf of the user, or the defacement of the website.

Technologies: VillaTheme Bopo – WooCommerce Product Bundle Builder. Vendors: VillaTheme.

Quick answers

Is CVE-2026-57422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57422 being exploited in the wild.
How severe is CVE-2026-57422?: High severity, with a CVSS score of 7.1, published 13 July 2026.
Which products and versions are affected?: VillaTheme Bopo – WooCommerce Product Bundle Builder <= 1.2.0.
Is there a fix for CVE-2026-57422?: A patch was published on 2026-07-08: Version 1.2.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57422 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57422?: Check whether you run VillaTheme Bopo – WooCommerce Product Bundle Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the VillaTheme Bopo – WooCommerce Product Bundle Builder plugin (bopo-woo-product-bundle-builder) for WordPress. The flaw stems from the improper neutralization of input during web page generation, allowing an unauthenticated attacker to inject malicious scripts into a victim's browser. Exploitation requires a user to interact with a specially crafted link or form. Successful exploitation can result in the execution of arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking or administrative account takeover. The issue is fixed in version 1.2.1.

Affected products

VillaTheme Bopo – WooCommerce Product Bundle Builder <= 1.2.0

Timeline

2026-06-03: disclosed: Reported by dutafi to Patchstack
2026-07-08: advisory: Patchstack published advisory
2026-07-13: advisory: NVD published CVE record
2026-07-08: patched: Version 1.2.1 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.