Unauthenticated XSS in WooCommerce Upsell Order Bump Plugin

Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw affecting the Upsell Order Bump Offer plugin for WooCommerce in versions 3.1.5 and earlier. XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users, potentially compromising customer data, session tokens, and payment information. With a CVSS score of 7.1, this poses a significant risk to e-commerce platforms. Any WooCommerce store using this plugin without proper patching is vulnerable to attacks that require no authentication, making it particularly attractive to threat actors. Affected organizations include small to medium-sized online retailers relying on this popular upsell plugin to increase order values.

Casky's 323 matching security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability, mapping to MITRE ATT&ACK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify reconnaissance activity as attackers probe for the vulnerable plugin version, followed by Initial Access attempts through malicious payload injection in unfiltered input fields. The platform's skill-based detection would flag suspicious script injection patterns in HTTP requests, POST data containing JavaScript payloads, and DOM manipulation attempts targeting the order bump form. Security teams would receive findings highlighting CWE-79 violations—specifically improper neutralization of input during web page generation—and see indicators of exploitation including unusual parameter values, encoded payloads, and attempts to access sensitive WooCommerce functions through injected scripts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-81288.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-81288

Casky has 323 skills that investigate the attack patterns behind CVE-2026-81288. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn