CVE-2026-106604: WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Q: Which deployments are affected?

The issue affects YITH WooCommerce Compare versions through 3.15.0. The available data does not identify a fixed version or any unaffected configuration.

Q: What level of access does an attacker need?

Exploitation requires network access, low privileges, and user interaction. The vulnerability is stored XSS, so attacker-supplied content may be retained and later executed when another user views the affected page or content.

Q: What should teams do if they cannot patch immediately?

The provided data does not list a workaround. Restrict low-privileged access to the WordPress site and review content or inputs handled by the plugin for suspicious injected script while awaiting a vendor-supported remediation.

Published Oct 15, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0.

Affected Software

1 affected component

YITH YITH WooCommerce Compare<=3.15.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/yith-woocommerce-compare to a version that resolves this vulnerability.
Fixed in 3.15.1

Event History

Oct 15, 2026

CVE Published

via MITRE·06:01 PM

Data Sourced

via MITRE·06:01 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects YITH WooCommerce Compare versions through 3.15.0. The available data does not identify a fixed version or any unaffected configuration.

What level of access does an attacker need?

Exploitation requires network access, low privileges, and user interaction. The vulnerability is stored XSS, so attacker-supplied content may be retained and later executed when another user views the affected page or content.

What should teams do if they cannot patch immediately?

The provided data does not list a workaround. Restrict low-privileged access to the WordPress site and review content or inputs handled by the plugin for suspicious injected script while awaiting a vendor-supported remediation.

CVE-2026-106604: WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What should teams do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What should teams do if they cannot patch immediately?