High severity · published Oct 29, 2026
CVE-2026-116409
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability
New
7.1
CVSS
–
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Reflected XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UO
Upsell Order Bump Offer for WooCommerce · WP Swings
through 3.1.6 · source: vendor
Affected product
UO
Upsell Order Bump Offer for WooCommerce
WP Swings
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116409
vdb-entry
https://patchstack.com/database/wordpress/plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
More from Upsell Order Bump Offer for WooCommerce
7.5
CVE-2026-49110
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability
7.1
CVE-2026-81288
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
6.5
CVE-2025-59565
WordPress Upsell Order Bump Offer for WooCommerce Plugin <= 3.0.7 - Cross Site Scripting (XSS) Vulnerability