CVE-2026-7804: WooCommerce Product Filter XSS Vulnerability

CVE-2026-7804 Overview

CVE-2026-7804 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Product Filter for WooCommerce by WBW plugin for WordPress. The flaw affects all versions up to and including 3.4.2. It stems from insufficient input sanitization and output escaping of the wpf_fid parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. Exploitation requires the targeted page to contain a filter that renders the vulnerable recalculation output. The issue is tracked as [CWE-79] and was published to the National Vulnerability Database (NVD) on 2026-09-09.

Critical Impact
Successful exploitation lets an unauthenticated attacker execute arbitrary JavaScript in a victim's browser session, enabling session token theft, credential harvesting, and administrative action hijacking on WooCommerce storefronts.

Affected Products

Product Filter for WooCommerce by WBW (woo-product-filter) plugin for WordPress
All versions up to and including 3.4.2
WordPress sites running WooCommerce with the vulnerable filter rendered on public pages

Discovery Timeline

2026-09-09 - CVE-2026-7804 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-7804

Vulnerability Analysis

The vulnerability is a reflected XSS flaw introduced by unsanitized handling of the wpf_fid request parameter. The plugin reads this parameter server-side and embeds it into the recalculation output rendered by the filter view without applying proper output escaping. When a victim visits a crafted URL that targets a page hosting the filter, the attacker-controlled payload is reflected back and executed in the victim's browser under the site's origin.

Because the attack executes in the context of the visited WooCommerce site, adversaries can steal authentication cookies, forge requests on behalf of authenticated shoppers or store administrators, and modify DOM content to perform phishing or drive-by redirection. The scope-changed nature of the flaw means script execution can affect resources beyond the vulnerable component's security boundary.

Root Cause

The root cause is missing input sanitization and output escaping in the code paths that handle the wpf_fid parameter. The plugin's request handler in classes/req.php, filter logic in modules/woofilters/mod.php, and rendering layer in modules/woofilters/views/woofilters.php pass attacker-controlled data into HTML output without calling WordPress escaping primitives such as esc_html(), esc_attr(), or wp_kses(). See the WordPress Woo Product Filter source for the affected view.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL to a WooCommerce page containing the plugin's filter, embedding a malicious payload in the wpf_fid query parameter. The attacker distributes the URL via phishing email, social media, or a malicious site. When the victim clicks the link, the server reflects the payload into the page and the browser executes the injected script. No authentication is required to craft or deliver the payload.

For technical detail on the vulnerable code paths, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-7804

Indicators of Compromise

HTTP requests containing suspicious payloads in the wpf_fid query parameter, particularly values that include <script>, javascript:, onerror=, or HTML-encoded variants.
Referrer headers on WooCommerce filter pages originating from unexpected external domains or URL shorteners.
Unexpected outbound requests from client browsers to attacker-controlled domains after users interact with WooCommerce filter pages.

Detection Strategies

Inspect web server access logs for GET requests to WooCommerce pages containing wpf_fid= with URL-encoded HTML or script content.
Deploy Web Application Firewall (WAF) rules that block reflected XSS patterns in query parameters targeting the woo-product-filter plugin endpoints.
Add browser Content Security Policy (CSP) reporting to surface script-source violations that indicate injection attempts.

Monitoring Recommendations

Monitor administrator account activity on WordPress sites running the plugin for anomalous logins, plugin installations, or user creations.
Alert on WordPress wp_options and user table modifications that follow visits to filter-enabled pages by privileged accounts.
Track WooCommerce order and customer data exfiltration patterns that could indicate post-XSS session abuse.

How to Mitigate CVE-2026-7804

Immediate Actions Required

Update the Product Filter for WooCommerce by WBW plugin to a version newer than 3.4.2 that includes the fix referenced in the WordPress plugin changeset 3686394.
Audit WordPress administrator and WooCommerce shop manager accounts for unauthorized changes and force password resets where suspicious activity is observed.
Invalidate active WordPress sessions to revoke any cookies potentially exposed through XSS during the exposure window.

Patch Information

The vendor addressed the flaw in the plugin update tracked by changeset 3686394. Site owners should apply the update via the WordPress plugin manager or WP-CLI. Verify the installed version is greater than 3.4.2 after upgrading. Review the Wordfence Vulnerability Report for confirmation of the fixed release.

Workarounds

Deactivate the Product Filter for WooCommerce by WBW plugin until the patched version is deployed.
Configure WAF or reverse-proxy rules to strip or reject requests containing HTML tags or script payloads in the wpf_fid parameter.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to limit XSS execution impact.

bash

# Update the vulnerable plugin using WP-CLI
wp plugin update woo-product-filter

# Verify the installed version is above 3.4.2
wp plugin get woo-product-filter --field=version

# Temporary mitigation: deactivate the plugin until patched
wp plugin deactivate woo-product-filter