CVE-2026-39437: WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected Cross-Site Scripting (XSS) vulnerability in the Min Max Step Quantity Limits Manager for WooCommerce WordPress plugin, affecting versions 5.2.2 and earlier. The flaw is reachable over the network with no authentication required, but a victim must be tricked into visiting a crafted URL. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session token theft, page content modification, and limited availability disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so the attacker must be able to send an HTTP request to the target WordPress site.

• AuthenticationNot required

  No account or session is needed; the attacker can deliver the malicious payload without any prior login.

• Victim interactionRequired

  A victim (typically a site visitor or admin) must click a crafted URL or otherwise load the attacker-controlled request in their browser for the script to execute.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond delivering the crafted link.

Blast Radius

• Reads browser-accessible session cookies or authentication tokens belonging to the victim, which an attacker can use to impersonate that user.
• Injects and executes arbitrary JavaScript in the victim's browser session, enabling modification of visible page content or redirection to attacker-controlled sites.
• Exfiltrates form input or other data the victim submits while the malicious script is active.
• Causes limited disruption to the victim's browser session on the affected site, consistent with the CVSS availability impact rating of Low.