Is CVE-2026-57686 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57686 being exploited in the wild.

How severe is CVE-2026-57686?

High severity, with a CVSS score of 7.1, published 2 July 2026.

Which products and versions are affected?

WPXPO WowAddons (Product Addons) <= 1.6.14.

Is there a fix for CVE-2026-57686?

A patch was published on 2026-07-02: Version 1.6.15 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57686 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57686?

Check whether you run WPXPO WowAddons (Product Addons) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57686: WPXPO WowAddons unauthenticated XSS

Q: Is there a fix for CVE-2026-57686?

A patch was published on 2026-07-02: Version 1.6.15 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57686 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57686?

Check whether you run WPXPO WowAddons (Product Addons) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57686 · Severity: high · CVSS 7.1 · Published 2026-07-02

WowAddons, a WordPress plugin used to add custom product options to e-commerce sites, contains a security flaw that allows attackers to inject malicious scripts. If a site administrator or visitor clicks on a specially crafted link, the attacker can execute code in their browser, potentially leading to unauthorized actions or the theft of sensitive session information. This vulnerability could be used to deface the website or redirect users to malicious locations.

Vendors: WPXPO.

Quick answers

Is CVE-2026-57686 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57686 being exploited in the wild.
How severe is CVE-2026-57686?: High severity, with a CVSS score of 7.1, published 2 July 2026.
Which products and versions are affected?: WPXPO WowAddons (Product Addons) <= 1.6.14.
Is there a fix for CVE-2026-57686?: A patch was published on 2026-07-02: Version 1.6.15 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57686 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57686?: Check whether you run WPXPO WowAddons (Product Addons) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the WPXPO WowAddons (also known as Product Addons) plugin for WordPress due to insufficient input sanitization and output escaping. The flaw allows an unauthenticated remote attacker to inject arbitrary web scripts into pages that are executed in the context of a victim's browser. Exploitation requires user interaction, such as a victim clicking a malicious link. The vulnerability is classified as CWE-79 and has been addressed in version 1.6.15.

Affected products

WPXPO WowAddons (Product Addons) <= 1.6.14

Timeline

2026-03-09: disclosed: Reported by Nguyen Ba Khanh
2026-06-30: advisory: Patchstack advisory published
2026-07-02: advisory: NVD published CVE-2026-57686
2026-07-02: patched: Version 1.6.15 released to address the issue

References

https://patchstack.com/database/wordpress/plugin/product-addons/vulnerability/wordpress-wowaddons-plugin-1-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.