CVE-2026-112199: WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YITH YITH WooCommerce Wishlistto a version that resolves this vulnerability.Fixed in 4.19.0
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vector indicates that an attacker needs low-level privileges and that user interaction is required. The issue is reachable over the network and has low attack complexity.
Which installations may be affected?
YITH WooCommerce Wishlist versions through 4.18.1 are identified as affected. The provided data does not state whether any particular WordPress or plugin configuration is required.
What is the potential impact of successful exploitation?
This is a stored XSS issue with low confidentiality, integrity, and availability impact. The scope is changed, meaning the vulnerable component could affect resources beyond its own security authority.