Medium · 6.5 CVE-2025-69088 EUVD-2025-205709GHSA-xp63-hvhq-5m3r

WordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability

Published Dec 30, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Vidish Product: Combo Offers WooCommerce Category: Web / CMS

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through <= 4.2.

Affected products

Vendor	Product	Affected	Fixed
Vidish	Combo Offers WooCommerce	≤ 4.2	—

References

https://patchstack.com/database/Wordpress/Plugin/woo-combo-offers/vulnerability/wordpress-combo-offers-woocommerce-plugin-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry