Back to the CVE list

CVE-2026-104926

WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter

CVSS score

6.1

EPSS probability

—

Risk score

0.6

Published

3 h ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

8.8

CVE-2026-81534Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter

Vendorthemehigh ProductEmail Customizer for WooCommerce (Pro)

Patch status unknownEPSS %016 d ago

5.3

CVE-2026-9832Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

Vendorthemehigh ProductPayment Gateway of Stripe for WooCommerce

Patch status unknownEPSS %11 mo ago

7.2

CVE-2026-102392WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Vendorthemehigh ProductExtra Product Options For WooCommerce | Custom Product Addons and Fields

Patch status unknownEPSS %01 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-104926"

CVE-2026-104926 · WooCommerce Extra Product Options Pro <=…