CVE-2026-106604: WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/yith-woocommerce-compareto a version that resolves this vulnerability.Fixed in 3.15.1
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects YITH WooCommerce Compare versions through 3.15.0. The available data does not identify a fixed version or any unaffected configuration.
What level of access does an attacker need?
Exploitation requires network access, low privileges, and user interaction. The vulnerability is stored XSS, so attacker-supplied content may be retained and later executed when another user views the affected page or content.
What should teams do if they cannot patch immediately?
The provided data does not list a workaround. Restrict low-privileged access to the WordPress site and review content or inputs handled by the plugin for suspicious injected script while awaiting a vendor-supported remediation.