CVE-2026-116409: WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability

Q: Which deployments are affected?

The issue affects WP Swings Upsell Order Bump Offer for WooCommerce versions through 3.1.6. The provided data does not identify an unaffected fixed version.

Q: What does an attacker need to exploit this issue?

The vector is network-accessible and requires no privileges, but exploitation requires user interaction. The vulnerability is a reflected XSS issue, meaning an attacker would need to induce a user to interact with a crafted request or content.

Q: What impact can successful exploitation have?

The severity data rates the issue 7.1 High and indicates low confidentiality, integrity, and availability impact. Its scope is changed, meaning the vulnerable component may affect resources beyond its own security authority.

Published Oct 29, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.

Affected Software

1 affected component

WP Swings Upsell Order Bump Offer for WooCommerce<=3.1.6

Event History

Oct 29, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects WP Swings Upsell Order Bump Offer for WooCommerce versions through 3.1.6. The provided data does not identify an unaffected fixed version.

What does an attacker need to exploit this issue?

The vector is network-accessible and requires no privileges, but exploitation requires user interaction. The vulnerability is a reflected XSS issue, meaning an attacker would need to induce a user to interact with a crafted request or content.

What impact can successful exploitation have?