5.3
Medium
CVE-2026-85350 The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently…
Description
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| UpsellWP 1.4 | 1.4.4 → < 2.2.10 | 2.2.10 |