{"id":"CVE-2026-105972","aliases":[],"title":"WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"Menu Cart for WooCommerce","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.2.1","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-105972"}],"remediation":[],"description":"The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.","severity":"unknown","score":null,"published":"2026-10-28T06:00:21.162Z","modified":"2026-10-28T17:58:08.920Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/579936d7-183f-4b25-acfd-b15f43eb573c/"],"sources":[{"name":"CVE","id":"CVE-2026-105972","modified":"2026-10-28T17:58:08.920Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-105972"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:55:32.564Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}