Medium severity · published Oct 3, 2026
CVE-2026-103888
WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The WooCommerce "redirect to cart after add to cart" option must be enabled for the filter that reads the woosq-redirect parameter to execute; however, the ?quick-view= auto-open mechanism means no further user interaction beyond loading the crafted URL is required to trigger script execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WPC Smart Quick View for WooCommerce · wpclever
through 4.4.0 · source: vendor
Affected product
WS
WPC Smart Quick View for WooCommerce
wpclever
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103888
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/fecb0a33-7608-4367-b9f6-0514b0bb2802?source=cve
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/tags/4.4.0/assets/js/frontend.js#L98
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/tags/4.4.0/wpc-smart-quick-view.php#L1372
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/woo-smart-quick-view/tags/4.4.0/wpc-smart-quick-view.php#L221
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?reponame=&old=3724035%40woo-smart-quick-view&new=3724035%40woo-smart-quick-view
More from WPC Smart Quick View for WooCommerce
6.4
CVE-2025-8618
WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode
6.4
CVE-2024-5020
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
5.3
CVE-2025-11741
WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure
4.4
CVE-2023-6494
WPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting