CVE-2026-15794: WooCommerce Grid/List View XSS Vulnerability

CVE-2026-15794 Overview

CVE-2026-15794 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Grid/List View for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 3.0.9 and stems from insufficient input sanitization and output escaping on the position shortcode attribute [CWE-79]. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages containing the shortcode. The injected script executes in the browser of any visitor who accesses the affected page. The shortcode's all_page="1" attribute expands the attack surface by forcing the widget to render on any page, not just shop or category pages.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and privilege escalation on the WordPress site.

Affected Products

Grid/List View for WooCommerce plugin for WordPress — all versions up to and including 3.0.9
WordPress sites running WooCommerce with this plugin installed
Any page or post rendering the vulnerable shortcode (including via all_page="1")

Discovery Timeline

2026-07-23 - CVE-2026-15794 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15794

Vulnerability Analysis

The Grid/List View for WooCommerce plugin exposes a shortcode that accepts a position attribute controlling widget placement. The plugin passes attacker-supplied position values into the rendered HTML without sanitization on input or escaping on output. This allows an authenticated user to store an arbitrary payload that the plugin later reflects into the page markup.

When a visitor loads a page containing the crafted shortcode, the browser parses and executes the injected script in the site's origin. Because the payload is stored in post content, execution is persistent rather than reflected. The all_page="1" attribute compounds the impact by allowing the widget to render outside its normal shop and category contexts.

Relevant source references identified by the reporter include the widget definition in WordPress Plugin Widget Code, the shortcode dispatcher in WordPress Plugin Main Code, and the template that emits the unescaped attribute in WordPress Plugin Template Code.

Root Cause

The root cause is missing input validation and missing output escaping for the position shortcode attribute. The plugin does not run the attribute through WordPress sanitization helpers such as sanitize_text_field() on ingestion, nor through context-appropriate escaping such as esc_attr() or esc_html() at render time. User-controlled data flows directly into HTML output.

Attack Vector

An attacker with contributor or higher privileges creates or edits a post containing the plugin's shortcode with a malicious position value carrying a JavaScript payload. The shortcode is saved to the database as part of post content. When any user later views the page, the plugin renders the payload into the DOM and the browser executes it under the site's origin. The vulnerability is network-reachable and requires no user interaction beyond visiting the affected page.

Because no verified public exploit code is available, refer to the Wordfence Vulnerability Report for additional analyst context.

Detection Methods for CVE-2026-15794

Indicators of Compromise

Post or page content containing the plugin's shortcode with position attribute values that include HTML tags, javascript: URIs, or event handlers such as onerror= and onload=.
Presence of the all_page="1" attribute on shortcodes stored in unexpected post types or locations.
Unusual outbound requests from visitor browsers to attacker-controlled domains originating from pages rendering the shortcode.
Newly created contributor or author accounts followed by edits to posts that embed the shortcode.

Detection Strategies

Search the wp_posts table for shortcode invocations of the plugin with suspicious position values using SQL patterns matching <script, onerror, or javascript:.
Review WordPress audit logs for post edits by contributor-level accounts that add or modify shortcode attributes.
Deploy a Web Application Firewall (WAF) rule to flag responses containing script content within rendered plugin markup.

Monitoring Recommendations

Monitor WordPress user role changes and new contributor account creation.
Alert on Content Security Policy (CSP) violations reported by browsers rendering affected pages.
Track outbound network telemetry from workstations of administrators who access the WordPress admin area, watching for credential exfiltration to unknown hosts.

How to Mitigate CVE-2026-15794

Immediate Actions Required

Update the Grid/List View for WooCommerce plugin to a version later than 3.0.9 once a fixed release is available from the vendor.
Audit all posts, pages, and widgets containing the plugin's shortcode and remove any suspicious position attribute values.
Restrict the contributor role to trusted users and review recent posts submitted for review by contributors.
Rotate WordPress administrator credentials and invalidate active sessions if any indicators of compromise are found.

Patch Information

A fix is referenced in the plugin's Subversion repository at WordPress Plugin Changeset History. Site administrators should apply the vendor update through the WordPress plugin manager as soon as the patched release is published to the plugin directory.

Workarounds

Deactivate the Grid/List View for WooCommerce plugin until the patched version is installed.
Remove contributor-level and above access from untrusted users to eliminate the authenticated prerequisite.
Deploy a WAF rule that blocks POST requests to wp-admin/post.php containing the plugin's shortcode with script-like payloads in position.
Implement a strict Content Security Policy that disallows inline scripts to limit execution of injected payloads.

bash

# Configuration example: disable the plugin from the command line using WP-CLI
wp plugin deactivate gridlist-view-for-woocommerce
wp plugin update gridlist-view-for-woocommerce