CVE-2026-97660 is a stored cross-site scripting vulnerability in the WPC Product Options for WooCommerce plugin for WordPress. The flaw exists in versions up to 4.0.5 due to improper neutralization of input in multipart Content-Disposition field names beginning with 'wpcpo-'. PHP's RFC1867 parser preserves these field names byte-for-byte and stores them into order item meta without adequate sanitization or escaping, enabling unauthenticated attackers to inject malicious scripts that execute when a user views the injected page. This vulnerability is exploitable without authentication, including during guest checkout.

An attacker can inject arbitrary web scripts that execute in the context of users visiting the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 7.2 (High) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to affected functionality. Monitoring for updates from the vendor wpclever is recommended.