{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/upsell-order-bump-offer-for-woocommerce-n/a--3.1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpswings:upsell_order_bump_offer_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-116409"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Upsell Order Bump Offer for WooCommerce (n/a \u003c= 3.1.6)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress","vulnerability"],"_cs_type":"advisory","_cs_vendors":["WP Swings"],"content_html":"\u003cp\u003eCVE-2026-116409 is a reflected cross-site scripting (XSS) vulnerability affecting the WP Swings Upsell Order Bump Offer for WooCommerce plugin. The flaw originates from improper neutralization of user-supplied input during web page generation. An attacker can exploit this by crafting a malicious URL that, when visited by a victim (such as an administrator), executes arbitrary JavaScript in the context of their session. This version range covers all installations from n/a through 3.1.6.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary script execution within the victim's browser session. Depending on the victim's privileges, this may lead to session hijacking, unauthorized actions on the WooCommerce store, or further site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the 'Upsell Order Bump Offer for WooCommerce' plugin.\u003c/li\u003e\n\u003cli\u003eUpdate the plugin to a version beyond 3.1.6 immediately upon the vendor's release of a patch.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to mitigate the impact of potential XSS attacks.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress web server access logs for requests containing suspicious script-like patterns or excessive parameters in URI queries.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T13:21:09Z","date_published":"2026-10-29T13:21:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-swings-xss/","summary":"A reflected cross-site scripting vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce (versions \u003c= 3.1.6) allows attackers to execute arbitrary scripts in a user's browser via crafted input.","title":"WP Swings Upsell Order Bump Offer for WooCommerce: Reflected Cross-site Scripting (CVE-2026-116409)","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-swings-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Upsell Order Bump Offer for WooCommerce (N/a \u003c= 3.1.6)","version":"https://jsonfeed.org/version/1.1"}