CVE-2026-85350: Unknown Upsellwp

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.

Affected products

• Unknown Upsellwp: from 1.4.4, before 2.2.10 (fixed in 2.2.10)

Published 2026-09-18. Last modified 2026-09-18.