CVE-2026-105972

HighCVSS 7.5/10Last modified Oct 28, 2026

Description

The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Menu Cart for WooCommerce	< 3.2.1

References

https://wpscan.com/vulnerability/579936d7-183f-4b25-acfd-b15f43eb573c/

Timeline

Published: Oct 28, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1059734.3The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing an CVE-2026-1059744.3The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data i CVE-2026-1059755.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and CVE-2026-1059764.7The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing CVE-2026-1059772.2The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment,CVE-2026-1059787.2Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system comman CVE-2026-1059797.2Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execut CVE-2026-1059807.2Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execu CVE-2026-1059817.2Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands a CVE-2026-1059827.2Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute t CVE-2026-1059858.8Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any CVE-2026-1059868.7Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a perce