CVE-2026-119517: WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The attack vector is network-based, requires no privileges, and has low attack complexity. Exploitation requires user interaction, consistent with delivery of a crafted request or link that triggers reflected XSS.

Q: Which plugin versions are affected?

Catna – Woo Name Your Price and Offers versions through 2.0.3 are affected. The available data does not identify a fixed version.

Q: What impact can successful exploitation have?

The reported CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful XSS could execute attacker-supplied script in the context of a user who interacts with the crafted content.

Published Nov 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3.

Affected Software

1 affected component

wordpress/catna-woo-name-your-price-and-offers<=2.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/catna-woo-name-your-price-and-offers to a version that resolves this vulnerability.
Fixed in 2.0.4

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack vector is network-based, requires no privileges, and has low attack complexity. Exploitation requires user interaction, consistent with delivery of a crafted request or link that triggers reflected XSS.

Which plugin versions are affected?

Catna – Woo Name Your Price and Offers versions through 2.0.3 are affected. The available data does not identify a fixed version.

What impact can successful exploitation have?

The reported CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful XSS could execute attacker-supplied script in the context of a user who interacts with the crafted content.

CVE-2026-119517: WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which plugin versions are affected?

What impact can successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which plugin versions are affected?

What impact can successful exploitation have?