Executive brief
The WPC Product Bundles for WooCommerce plugin, used to sell bundled product offers on WordPress e-commerce sites, contains a stored cross-site scripting flaw in its order quantity parameter. Unauthenticated attackers can inject malicious scripts that execute when customers view product pages, potentially stealing session tokens, capturing payment information, or defacing the storefront.
Technical details
The vulnerability exists in the 'qty' parameter due to insufficient input sanitization and output escaping; a numeric-prefixed payload like '1<img src=x onerror=...>' bypasses float-cast validation and is stored verbatim in order item metadata under the '_woosb_ids' key. The flaw requires no authentication and is triggered when any user accesses an injected page. The malicious HTML persists in the database and executes in the context of all users viewing the affected order or product page.
Affected products
- WPC Product Bundles for WooCommerce up to 8.6.6
Timeline
- 2026-09-22: disclosed