CVE-2026-7804: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in woobewoo Product Filter for WooCommerce by WBW

CVE-2026-7804 is a reflected cross-site scripting vulnerability in the Product Filter for WooCommerce by WBW WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'wpf_fid' parameter, affecting all versions up to and including 3.4.2. An attacker can craft a malicious URL containing script code in this parameter, which executes in the victim’s browser when they visit a page with the vulnerable filter recalculation output. The vulnerability requires user interaction (clicking a link) and does not require authentication.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim’s browser, potentially allowing theft of cookies, session tokens, or other sensitive information accessible to the browser. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity), indicating limited but meaningful impact on confidentiality and integrity without affecting availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable filter functionality or apply manual input sanitization and output escaping if feasible. Monitor the vendor’s communications for updates and apply patches promptly once available.