{"id":"CVE-2026-105972","revision":"8e35d24bf1ff407b934baa6b5d677c1d","records":[{"revision":"8e35d24bf1ff407b934baa6b5d677c1d","observedAt":"2026-10-28T18:46:48.818+00:00","statement":{"source":"cve-program","id":"CVE-2026-105972","aliases":[],"title":"WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute","description":"The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.","state":0,"publishedAt":"2026-10-28T06:00:21.162+00:00","modifiedAt":"2026-10-28T17:58:08.92+00:00","affected":[{"ecosystem":"Vendor product","name":"Menu Cart for WooCommerce","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Menu Cart for WooCommerce\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.2.1\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/579936d7-183f-4b25-acfd-b15f43eb573c/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105972","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105972","identifiers":["CVE-2026-105972"]},"retained":false,"historicalAffected":[]}],"coverage":[]}