CVE-2026-97268
HighCVSS 7.1Summary
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Risk Assessment
Risk of session theft, account takeover, or malicious actions in the victim's browser context, potentially leading to data confidentiality breaches.
Recommendation
Update the Premmerce Wishlist for WooCommerce plugin to the latest version. Additionally, apply anti-XSS filters and input validation.
Other vulnerabilities in Premmerce Wishlist for WooCommerce
See all- CVE-2026-97273High
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
- CVE-2026-54849Critical
The Premmerce Wishlist plugin for WooCommerce versions up to 1.1.11 contains a vulnerability to unauthenticated SQL injection.
- CVE-2025-13440Medium
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS