CVE-2026-114701: WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

Q: What level of access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The attack can be performed over the network with low attack complexity.

Q: What is the potential impact if exploitation succeeds?

This is a stored XSS issue. The supplied severity vector indicates low impact to confidentiality, integrity, and availability, with impacts crossing a security scope boundary.

Q: Which plugin versions are affected?

Versions through 2.9.1 of Waitlist Woocommerce (Back in stock notifier) are affected. The available data does not identify a fixed version.

Published Oct 22, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) waitlist-woocommerce allows Stored XSS.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.9.1.

Affected Software

1 affected component

XootiX Waitlist Woocommerce (Back in stock notifier)<=2.9.1

Event History

Oct 22, 2026

CVE Published

via MITRE·08:55 AM

Data Sourced

via MITRE·08:55 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The attack can be performed over the network with low attack complexity.

What is the potential impact if exploitation succeeds?

This is a stored XSS issue. The supplied severity vector indicates low impact to confidentiality, integrity, and availability, with impacts crossing a security scope boundary.

Which plugin versions are affected?