CVE-2026-103888Published
WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-103888 · Microsoft / collected KEV context
cve-program · CVE-2026-103888
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fecb0a33-7608-4367-b9f6-0514b0bb2802?source=cve
- https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/tags/4.4.0/assets/js/frontend.js#L98
- https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/tags/4.4.0/wpc-smart-quick-view.php#L1372
- https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/tags/4.4.0/wpc-smart-quick-view.php#L221
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3724035%40woo-smart-quick-view&new=3724035%40woo-smart-quick-view
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.