CVE-2026-7804: Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpffid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Product Filter for WooCommerce by WBWto a version that resolves this vulnerability.Fixed in 3.4.2 - Configuration
Update/patch the plugin so the 'wpf_fid' parameter is both sufficiently sanitized and properly output-escaped to prevent reflected XSS on pages where the vulnerable filter output is present.
WordPress plugin: Product Filter for WooCommerce by WBW wpf_fid parameter output escaping = Ensure output is properly escaped before rendering
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
WordPress sites using Product Filter for WooCommerce by WBW version 3.4.2 or earlier are affected when a targeted page contains a filter that uses the vulnerable recalculation output.
What does an attacker need to exploit it?
An attacker does not need authentication and can supply a crafted wpf_fid parameter. They must persuade a user to perform an action such as clicking a crafted link, and the request must target a page with the relevant filter present.
How could exploitation affect a user?
Successful exploitation causes attacker-supplied web script to execute in the affected page in the user's browser. The reported impact includes low confidentiality and integrity impact, with no availability impact.