CVE-2026-57356

HighCVSS 7.1

Published: 02/07/2026(UTC)Updated: 25/10/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The MC Woocommerce Wishlist plugin version 1.9.19 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

Risk Assessment

The risk involves potential session hijacking, redirection to malicious sites, or theft of sensitive data through script execution in the victim's browser.

Recommendation

It is recommended to immediately update the MC Woocommerce Wishlist plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in MC Woocommerce Wishlist

CVE-2026-66631High
The MC Woocommerce Wishlist plugin in versions up to and including 1.9.21 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS