PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-15306 rextheme CVE debrief

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability has a CVSS score of 6.1 and is considered Medium severity. Users of the plugin should be aware of this vulnerability and take immediate action to protect their applications.

Vendor
rextheme
Product
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-16
Original CVE updated
2026-07-16
Advisory published
2026-07-16
Advisory updated
2026-07-16

Who should care

Users of Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress should be aware of this vulnerability and take immediate action to protect their applications. This includes updating to a patched version of the plugin, implementing additional input validation and output encoding, and monitoring for suspicious activity.

Technical summary

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter. This vulnerability exists in all versions up to, and including, 7.6.1. The vulnerability is caused by insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability has a CVSS score of 6.1 and is considered Medium severity.

Defensive priority

Medium priority given the CVSS score of 6.1 and the potential for attackers to inject arbitrary web scripts.

Recommended defensive actions

  • Update to a patched version of the plugin if available.
  • Implement additional input validation and output encoding for the 's' Search Parameter.
  • Monitor for suspicious activity related to the plugin's search functionality.
  • Consider implementing a web application firewall (WAF) to detect and prevent similar attacks.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from the CVE record and NVD detail indicate that the vulnerability exists in the Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress. The CVE record was published on 2026-07-16T05:16:18.170Z and has not been modified since then. The vulnerability has a CVSS score of 6.1 and is considered Medium severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-16T05:16:18.170Z and has not been modified since then.