PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39437 WPFactory CVE debrief

A high-severity Unauthenticated Cross Site Scripting (XSS) vulnerability was discovered in the Min Max Step Quantity Limits Manager for WooCommerce plugin, affecting versions up to 5.2.2. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity.

Vendor
WPFactory
Product
Min Max Step Quantity Limits Manager for WooCommerce
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-16
Original CVE updated
2026-06-16
Advisory published
2026-06-16
Advisory updated
2026-06-16

Who should care

Users of the Min Max Step Quantity Limits Manager for WooCommerce plugin, particularly those using versions up to 5.2.2, should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability is an Unauthenticated Cross Site Scripting (XSS) issue in the Min Max Step Quantity Limits Manager for WooCommerce plugin. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Defensive priority

HIGH

Recommended defensive actions

  • Update the Min Max Step Quantity Limits Manager for WooCommerce plugin to a version that is not vulnerable.
  • Refer to the vendor's documentation or support resources for guidance on updating the plugin.

Evidence notes

The vulnerability was reported by [email protected] and is referenced in the CVE record.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39437 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39437

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39437 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39437

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.