WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97660 · Microsoft / collected KEV context

cve-program · CVE-2026-97660

• https://www.wordfence.com/threat-intel/vulnerabilities/id/13a52c43-c14c-4322-9191-297e6c647d92?source=cve
• https://plugins.trac.wordpress.org/browser/wpc-product-options/tags/4.0.5/includes/class-cart.php#L579
• https://plugins.trac.wordpress.org/browser/wpc-product-options/tags/4.0.5/includes/class-cart.php#L792
• https://plugins.trac.wordpress.org/browser/wpc-product-options/tags/4.0.5/includes/class-cart.php#L336
• https://plugins.trac.wordpress.org/browser/wpc-product-options/tags/4.0.5/includes/class-cart.php#L537
• https://plugins.trac.wordpress.org/browser/wpc-product-options/tags/4.0.5/includes/class-cart.php#L573
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3712354%40wpc-product-options&new=3712354%40wpc-product-options

No related operational record is retained in the current change model.