CVE-2026-1986: FloristPress for Woo XSS Vulnerability

CVE-2026-1986 Overview

CVE-2026-1986 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the FloristPress for Woo WordPress plugin (bakkbone-florist-companion). The flaw resides in the handling of the noresults parameter within src/core/ajax.php, where user-supplied input is reflected back without adequate sanitization or output escaping. All plugin versions up to and including 7.8.2 are affected. Unauthenticated attackers can craft malicious links that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation enables session hijacking, credential theft, administrative action abuse, and arbitrary content injection on affected WooCommerce florist storefronts.

Affected Products

FloristPress for Woo WordPress plugin (bakkbone-florist-companion) versions up to and including 7.8.2
WordPress sites running WooCommerce with the FloristPress for Woo extension enabled
Customer-facing eCommerce storefronts using the plugin's AJAX search/results functionality

Discovery Timeline

2026-03-26 - CVE-2026-1986 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-1986

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the FloristPress for Woo plugin's AJAX handler. The plugin processes a noresults request parameter and embeds its value into HTML responses without applying WordPress's standard escaping functions such as esc_html(), esc_attr(), or wp_kses(). Because the affected code path is reachable without authentication, any visitor can trigger the reflection. An attacker delivers a crafted URL containing JavaScript payloads in the noresults parameter. When a logged-in administrator or shop manager loads that URL, the injected script executes in the context of the WordPress origin. The flaw requires user interaction (UI:R) and crosses a security scope (S:C) because client-side execution can affect both visitor and site administrator contexts.

Root Cause

The root cause is missing input sanitization and output escaping at the reflection point in src/core/ajax.php around line 1583. The plugin trusts the noresults parameter and concatenates it directly into rendered output, violating secure-by-default WordPress development guidance.

Attack Vector

Exploitation occurs over the network with low complexity and no authentication. The attacker constructs a URL with a malicious noresults payload, then delivers it through phishing, forum posts, or chat messages. When a target clicks the link, the browser renders the unescaped payload and executes script under the vulnerable site's origin, enabling cookie theft, forced administrative actions, and credential phishing overlays.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the affected reflection point.

Detection Methods for CVE-2026-1986

Indicators of Compromise

HTTP requests containing the noresults parameter with values that include <script>, javascript:, onerror=, onload=, or URL-encoded equivalents (%3Cscript%3E).
Web server access logs showing unusually long query strings targeting FloristPress AJAX endpoints.
Referrer values pointing to external domains preceding administrator session anomalies.
Unexpected outbound browser requests from administrative sessions to attacker-controlled domains.

Detection Strategies

Inspect WordPress AJAX request logs for noresults parameter values containing HTML or JavaScript syntax.
Deploy WAF rules that flag reflected XSS patterns in query parameters destined for wp-admin/admin-ajax.php and plugin endpoints.
Correlate phishing email telemetry with clicks on URLs targeting WooCommerce florist sites.
Audit the installed plugin version against the affected range (≤ 7.8.2) across managed WordPress estates.

Monitoring Recommendations

Enable verbose HTTP request logging on edge proxies and forward logs to a centralized analytics platform for retroactive hunting.
Monitor administrator account activity for unexpected privilege changes, new user creation, or plugin installations following click events.
Track Content Security Policy (CSP) violation reports for script-src blocks originating from affected pages.
Alert on outbound requests from browsers to known credential-harvesting infrastructure following visits to the WordPress site.

How to Mitigate CVE-2026-1986

Immediate Actions Required

Update the FloristPress for Woo plugin to a version newer than 7.8.2 as soon as the patched release is available from the plugin author.
If a patched version is unavailable, deactivate and remove the bakkbone-florist-companion plugin until remediation is published.
Force a logout of all administrator and shop manager sessions and rotate credentials for privileged WordPress accounts.
Review recent administrative activity, installed plugins, and theme files for unauthorized modifications.

Patch Information

A fix is tracked in the plugin repository under WordPress Change Log Entry changeset 3487687. Site administrators should apply updates via the WordPress dashboard or by deploying the patched plugin package from the official WordPress.org plugin directory.

Workarounds

Configure a Web Application Firewall rule that blocks or sanitizes the noresults parameter when it contains HTML tags or JavaScript keywords.
Implement a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins.
Restrict access to WooCommerce administrative pages by IP allow-listing where feasible.
Train administrators and shop staff to avoid clicking unsolicited links pointing to their own storefront with unusual query parameters.

bash

# Example WAF rule (ModSecurity) blocking reflected XSS in the noresults parameter
SecRule ARGS:noresults "@rx (?i)(<script|javascript:|onerror=|onload=|<svg|<iframe)" \
    "id:1002026,phase:2,deny,status:403,log,\
     msg:'CVE-2026-1986 FloristPress noresults XSS attempt blocked'"