CVE-2026-93836 describes a stored cross-site scripting vulnerability in the WPC Product Bundles for WooCommerce plugin for WordPress. The issue exists in all versions up to 8.6.6 due to improper input sanitization and output escaping of the 'qty' parameter. Attackers can inject arbitrary web scripts that are stored in order item metadata under the '_woosb_ids' key. The vulnerability is facilitated by a float cast in quantity validation that allows payloads starting with a number followed by malicious HTML to pass validation and be stored verbatim, leading to script execution when the injected page is accessed.

An unauthenticated attacker can inject malicious scripts that execute in the context of users viewing the affected pages, potentially leading to information disclosure and limited integrity impact. The CVSS score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the affected plugin versions and monitor for updates from the vendor. Avoid exposing the vulnerable parameter to untrusted input where possible.