CVE-2026-81282: WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs a Subscriber-level account on a WordPress site using the affected plugin. Exploitation also requires a user to interact with the attacker-supplied content.

Q: What impact can successful exploitation have?

The vulnerability is cross-site scripting and is rated medium severity with low confidentiality, integrity, and availability impact. Its scope is changed, indicating the impact can extend beyond the vulnerable component.

Q: Which plugin versions are affected?

Product Variations Swatches for WooCommerce versions 1.1.18 and earlier are identified as affected.

Published Sep 3, 2026

Updated

Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.

Affected Software

1 affected component

WooCommerce Product Variations Swatches for WooCommerce<=1.1.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Product Variations Swatches for WooCommerce to a version that resolves this vulnerability.
Fixed in 1.1.19

Event History

Sep 3, 2026

CVE Published

via MITRE·04:31 PM

Data Sourced

via MITRE·04:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a Subscriber-level account on a WordPress site using the affected plugin. Exploitation also requires a user to interact with the attacker-supplied content.

What impact can successful exploitation have?