Upsell Order Bump Offer for WooCommerce (N/a <= 3.1.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/upsell-order-bump-offer-for-woocommerce-n/a--3.1.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 13:21:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWP Swings Upsell Order Bump Offer for WooCommerce: Reflected Cross-site Scripting (CVE-2026-116409)https://feed.craftedsignal.io/briefs/2026-10-wp-swings-xss/Thu, 29 Oct 2026 13:21:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wp-swings-xss/A reflected cross-site scripting vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce (versions <= 3.1.6) allows attackers to execute arbitrary scripts in a user's browser via crafted input.CVE-2026-116409 is a reflected cross-site scripting (XSS) vulnerability affecting the WP Swings Upsell Order Bump Offer for WooCommerce plugin. The flaw originates from improper neutralization of user-supplied input during web page generation. An attacker can exploit this by crafting a malicious URL that, when visited by a victim (such as an administrator), executes arbitrary JavaScript in the context of their session. This version range covers all installations from n/a through 3.1.6.

Impact

Successful exploitation allows for arbitrary script execution within the victim's browser session. Depending on the victim's privileges, this may lead to session hijacking, unauthorized actions on the WooCommerce store, or further site compromise.

Recommendation

  • Inventory all WordPress instances running the 'Upsell Order Bump Offer for WooCommerce' plugin.
  • Update the plugin to a version beyond 3.1.6 immediately upon the vendor's release of a patch.
  • Implement a Content Security Policy (CSP) to mitigate the impact of potential XSS attacks.
  • Monitor WordPress web server access logs for requests containing suspicious script-like patterns or excessive parameters in URI queries.
]]>highadvisoryxssweb-applicationwordpressvulnerability