CVE-2026-59553
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Product Feed Manager plugin up to version 7.6.1. Allows an attacker to inject malicious scripts.
Risk Assessment
An attacker can steal session data, modify page content, or conduct phishing attacks on users.
Recommendation
Update the Product Feed Manager plugin to the latest version. Use input validation and Content-Security-Policy headers.
Other vulnerabilities in Product Feed Manager
See all- CVE-2026-118093Medium
The Product Feed Manager plugin by WPFunnels Team (up to version 7.14.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-66580High
The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.
- CVE-2026-118089High
The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS