Product Filter for WooCommerce by WBW: Reflected Cross-Site Scripting

Summary

The WordPress plugin Product Filter for WooCommerce by WBW contains a reflected Cross-Site Scripting flaw in the 'text_no_products' parameter, caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages of the store. The script runs only if a victim is tricked into opening a crafted link, for example a customer or a logged-in site administrator.

Affected

• Product Filter for WooCommerce by WBW (WordPress plugin, woobewoo) up to and including 3.4.5
• The WBW PRO edition has not been verified.

Fixed in

• Unknown. No fixed version has been confirmed in the available sources; 3.4.5 is affected.

Workaround

• No vendor workaround found.
• Deactivate the plugin if the product filter is not business-critical.
• Use a WAF rule to block script markup in the affected parameter, after review with your WAF vendor.
• Do not click unknown links while logged in to the WordPress backend.

Exploitation

• NVD status: Deferred.
• Third-party tracker OffSeq lists it as not known to be exploited.
• No public proof-of-concept found in the available sources.
• The CISA KEV catalogue was not checked.

Our recommendation

• Check whether any WooCommerce shop uses this plugin in version 3.4.5 or earlier, especially internet-facing shops.
• Update to a fixed version as soon as the vendor publishes one; check the WordPress.org changelog and the Wordfence advisory.
• Apply the interim measures above until a fix is installed.
• Note that the related CVE-2026-88942 (parameter 'wpf_fid') also affects versions up to 3.4.6, so review the plugin across all versions.
• Ask administrators to avoid clicking unknown links while logged in.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record www.cve.org
• Wordfence advisory www.wordfence.com
• WordPress changeset 3731161 plugins.trac.wordpress.org
• Vulnerable code, tag 3.4.4 (class-woobewoo-pf-req.php) plugins.trac.wordpress.org
• OffSeq threat radar radar.offseq.com
• Strix CVE entry www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:13.