Stored Cross-Site Scripting in WPC Product Bundles for WooCommerce

The WPC Product Bundles for WooCommerce plugin (all versions up to and including 8.6.6) contains a critical Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-93836. The vulnerability stems from insufficient input sanitization of the 'qty' parameter. Although the plugin performs a float cast validation for the quantity input, this mechanism is flawed; it allows numeric-prefixed payloads such as "1<img src=x onerror=alert(1)>" to pass validation while preserving the malicious HTML content.

This malicious payload is subsequently stored in the database within order item metadata under the '_woosb_ids' key. When an administrator or authorized user views the compromised order details page within the WordPress dashboard, the injected script executes in their browser session. This vulnerability poses a significant risk as it permits unauthenticated attackers to perform actions on behalf of privileged users, potentially leading to full site compromise.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session. If the victim is an administrator, this can lead to unauthorized administrative actions, account takeover, or the installation of malicious plugins. This affects any WordPress environment utilizing WPC Product Bundles for WooCommerce version 8.6.6 or earlier.

Recommendation

• Update the WPC Product Bundles for WooCommerce plugin to a version released after 8.6.6 that addresses CVE-2026-93836.
• Monitor web application firewall logs for requests targeting WooCommerce endpoints containing HTML tags or script injection patterns within the 'qty' parameter.
• Audit existing WooCommerce order metadata for entries containing suspicious HTML tags or script attributes.