CVE-2026-112199
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The YITH WooCommerce Wishlist plugin up to version 4.18.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious JavaScript can be persistently stored and executed in a user's browser.
Risk Assessment
An attacker could execute arbitrary script in the context of an administrator or customer session, potentially leading to data theft or account takeover.
Recommendation
Update the YITH WooCommerce Wishlist plugin to a version later than 4.18.1 and enforce server-side input validation.
Other vulnerabilities in YITH WooCommerce Wishlist
See all- CVE-2026-27329Medium
The YITH WooCommerce Wishlist plugin up to version 4.12.0 contains an authorization bypass through a user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.
- CVE-2025-12427Medium
The YITH WooCommerce Wishlist plugin for WordPress in all versions up to and including 4.10.0 is vulnerable to Insecure Direct Object Reference via the REST API endpoint and AJAX handler due to missing validation on user-controlled keys. This allows unauthenticated attackers to discover any user's wishlist token ID and subsequently rename the victim's wishlist without authorization.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS