WPC Smart Quick View for WooCommerce <= 4.4.0 - Unauthenticated Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
- ID
- WPSEC-2026-0366
- Plugin
- WPC Smart Quick View for WooCommerce (woo-smart-quick-view)
- Affected
- all versions before 4.4.1
- Remediation
- Update to 4.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WPC Smart Quick View for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-103888, on 2026-10-02.
Description
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0. This is due to insufficient validation and output escaping of the redirect URL: the plugin's WooCommerce add-to-cart redirect filter returned the request's 'woosq-redirect' value, which was passed to the plugin's front-end script as the cart URL and inserted into the quick view's HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link, on sites where WooCommerce's 'Redirect to the cart page after successful addition' option is enabled. On those sites the same value could also send shoppers to an arbitrary external site after an AJAX add to cart.
References
- https://wpsec.com/vuln/WPSEC-2026-0366/
- https://plugins.svn.wordpress.org/woo-smart-quick-view/tags/4.4.1/
- https://wordpress.org/plugins/woo-smart-quick-view/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS