CVE-2026-7804: Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter

Published Sep 9, 2026
·
Updated

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpffid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.

Affected Software

1 affected component
WordPress plugin "Product Filter for WooCommerce" by WBW<=3.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade WordPress plugin: Product Filter for WooCommerce by WBW to a version that resolves this vulnerability.

    Fixed in 3.4.2
  2. Configuration

    Update/patch the plugin so the 'wpf_fid' parameter is both sufficiently sanitized and properly output-escaped to prevent reflected XSS on pages where the vulnerable filter output is present.

    WordPress plugin: Product Filter for WooCommerce by WBW wpf_fid parameter output escaping = Ensure output is properly escaped before rendering

Event History

Sep 9, 2026
CVE Published
via MITRE·03:28 AM
Data Sourced
via MITRE·03:28 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed to this issue?

WordPress sites using Product Filter for WooCommerce by WBW version 3.4.2 or earlier are affected when a targeted page contains a filter that uses the vulnerable recalculation output.

2

What does an attacker need to exploit it?

An attacker does not need authentication and can supply a crafted wpf_fid parameter. They must persuade a user to perform an action such as clicking a crafted link, and the request must target a page with the relevant filter present.

3

How could exploitation affect a user?

Successful exploitation causes attacker-supplied web script to execute in the affected page in the user's browser. The reported impact includes low confidentiality and integrity impact, with no availability impact.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203