These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag [truncated]
CVE-2026-104313 is a Reflected Cross-Site Scripting vulnerability in the WPC Estimated Delivery Date for WooCommerce plugin for WordPress. The vulnerability exists in all versions up to and including 4.0.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts if they can trick a user into performing an action such as clicking on a link.
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing [truncated]
The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This vulnerability allows an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrator's user ID to the wpcsa_login endpoint and receiving a full Administrator session cookie without supplying th [truncated]
A high-severity vulnerability, CVE-2026-49061, with a CVSS score of 7.5, was published on June 15, 2026, affecting WPC Product Options for WooCommerce versions up to 3.2.1. This vulnerability allows unauthenticated arbitrary file downloads, potentially leading to sensitive information disclosure.
CVE-2026-48883 is a HIGH severity vulnerability in WPC Product Bundles for WooCommerce plugin versions <= 8.5.3. The vulnerability is caused by Unauthenticated Broken Access Control. The CVSS score for this vulnerability is 7.5.
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages [truncated]