CVE-2026-81282: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in VillaTheme Product Variations Swatches for WooCommerce

This vulnerability (CVE-2026-81282) is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to cross-site scripting (XSS). It specifically impacts the Product Variations Swatches for WooCommerce plugin by VillaTheme, allowing subscriber-level users to execute scripts in the context of other users. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges at the subscriber level, user interaction, and resulting in partial confidentiality, integrity, and availability impacts. The vulnerability is confirmed in versions up to 1.1.18, but no patch or official remediation level has been disclosed.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. This could facilitate actions such as session hijacking or unauthorized actions within the affected WooCommerce environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict subscriber privileges where possible and monitor for suspicious activity related to the plugin. Avoid exposing the vulnerable plugin to untrusted users if feasible.