CVE-2026-57422: Bopo WooCommerce Bundle Builder XSS Flaw

CVE-2026-57422 Overview

CVE-2026-57422 is a reflected Cross-Site Scripting (XSS) vulnerability in the VillaTheme Bopo – WooCommerce Product Bundle Builder plugin for WordPress. The flaw affects all versions of the bopo-woo-product-bundle-builder plugin up to and including 1.2.0. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in the victim's browser. Exploitation requires user interaction, typically through a crafted link. The vulnerability is classified under CWE-79 and carries a network attack vector with low complexity.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of authenticated WooCommerce administrators, enabling session theft, credential harvesting, and unauthorized store actions.

Affected Products

VillaTheme Bopo – WooCommerce Product Bundle Builder plugin versions up to and including 1.2.0
WordPress sites running WooCommerce with the bopo-woo-product-bundle-builder plugin installed
WooCommerce store administrators and privileged users accessing crafted links

Discovery Timeline

2026-07-13 - CVE-2026-57422 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57422

Vulnerability Analysis

The vulnerability stems from improper neutralization of input during web page generation in the Bopo WooCommerce Product Bundle Builder plugin. User-controlled parameters are reflected into HTML responses without proper output encoding or input sanitization. An attacker crafts a URL containing malicious JavaScript payloads and delivers it to a victim through phishing, social engineering, or embedded links. When the victim clicks the link, the plugin echoes the payload into the response page, and the browser executes it under the site's origin.

The scope-changed impact indicates the injected script can affect resources beyond the vulnerable component itself, including cookies, session tokens, and DOM elements belonging to the parent WordPress administration context. The EPSS probability is 0.18%, reflecting low but non-zero probability of exploitation activity within 30 days.

Root Cause

The root cause is missing input validation and output escaping on request parameters processed by the plugin. The plugin accepts request data and inserts it directly into rendered HTML without applying WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). This omission allows arbitrary HTML and script tags to survive into the served response.

Attack Vector

The attack requires network access to the vulnerable site and user interaction to trigger the reflected payload. An attacker constructs a URL targeting a vulnerable endpoint of the plugin with a JavaScript payload embedded in a parameter. The attacker then sends this URL to an authenticated WordPress user, typically a shop manager or administrator. When the target loads the URL, the payload executes in the site's origin, granting the attacker access to session cookies, CSRF tokens, and any actions the victim is authorized to perform.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for further technical details.

Detection Methods for CVE-2026-57422

Indicators of Compromise

Web server access logs containing requests to bopo-woo-product-bundle-builder endpoints with URL parameters containing <script>, javascript:, onerror=, or encoded equivalents such as %3Cscript%3E.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following a click on a suspicious link.
Anomalous WordPress admin session activity, including new administrative users or plugin/theme modifications performed shortly after link interaction.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings and POST bodies targeting the plugin's endpoints for HTML tag and JavaScript event handler patterns.
Monitor WordPress audit logs for privileged account activity that correlates with reflected XSS payload delivery via email or messaging platforms.
Perform authenticated vulnerability scans against WooCommerce installations to identify sites running bopo-woo-product-bundle-builder version 1.2.0 or earlier.

Monitoring Recommendations

Centralize WordPress, WooCommerce, and reverse-proxy logs into a SIEM and alert on request parameters containing script tag patterns or Base64-encoded payloads.
Track browser-side Content Security Policy (CSP) violation reports to identify attempted script injections in real time.
Alert on session token reuse from geographically inconsistent source IPs, which may indicate cookie theft resulting from successful XSS exploitation.

How to Mitigate CVE-2026-57422

Immediate Actions Required

Identify all WordPress sites running the Bopo – WooCommerce Product Bundle Builder plugin and confirm the installed version.
Disable or remove the plugin on any site running version 1.2.0 or earlier until a patched release is applied.
Force password resets and terminate active sessions for WooCommerce administrators if suspicious link interaction is suspected.

Patch Information

No patched version is listed in the NVD entry at the time of publication. The vulnerability affects versions up to and including 1.2.0. Monitor the Patchstack Vulnerability Report and the VillaTheme vendor channels for a security release addressing CVE-2026-57422.

Workarounds

Deploy a WAF rule blocking requests to the plugin's endpoints that contain HTML tag delimiters or JavaScript event attributes in parameters.
Enforce a strict Content Security Policy on the WordPress site that disallows inline scripts and unauthorized script sources.
Train administrators to avoid clicking untrusted links, particularly those referencing WooCommerce admin URLs with unusual query parameters.

bash

# Example nginx configuration to block common reflected XSS patterns
location ~* /wp-content/plugins/bopo-woo-product-bundle-builder/ {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}

# Add a restrictive Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none';" always;