{"id":"CVE-2026-109988","revision":"22054cb16ee14075acdad59958f6bd14","records":[{"revision":"22054cb16ee14075acdad59958f6bd14","observedAt":"2026-10-28T08:06:08.476+00:00","statement":{"source":"cve-program","id":"CVE-2026-109988","aliases":[],"title":"Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter","description":"The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","state":0,"publishedAt":"2026-10-28T06:45:17.956+00:00","modifiedAt":"2026-10-28T06:45:17.956+00:00","affected":[{"ecosystem":"Vendor product","name":"Product Addons for Woocommerce – Product Options with Custom Fields","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"acowebs\",\n                    \"product\": \"Product Addons for Woocommerce – Product Options with Custom Fields\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"3.1.8\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","score":4.4,"severity":"MEDIUM"}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/99c24e6f-396a-45bd-b16e-cb3b30aff25c?source=cve","https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/templates/cart/cart-item-data.php#L14","https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/backend/api.php#L237","https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/helper.php#L284","https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/process/process.php#L262","https://plugins.trac.wordpress.org/browser/woo-custom-product-addons/tags/3.1.8/includes/process/cart.php#L109","https://wordpress.org/plugins/woo-custom-product-addons/","https://plugins.trac.wordpress.org/changeset/3756829/woo-custom-product-addons/trunk/templates/cart/cart-item-data.php"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109988","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-109988","identifiers":["CVE-2026-109988"]},"retained":false,"historicalAffected":[]}],"coverage":[]}