CVE-2026-120855: WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates an attacker needs low-level privileges and user interaction. Exploitation is network-accessible and does not require high attack complexity.

Q: What is the likely impact if exploitation succeeds?

This is a stored XSS issue, meaning attacker-supplied content can be retained and later executed in a user's browser. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability, with scope changed.

Q: Which plugin versions are affected?

TI WooCommerce Wishlist versions through 2.14.0 are affected. The available data does not identify a fixed version.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.

Affected Software

1 affected component

TemplateInvaders TI WooCommerce Wishlist<=2.14.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/ti-woocommerce-wishlist to a version that resolves this vulnerability.
Fixed in 2.14.1

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates an attacker needs low-level privileges and user interaction. Exploitation is network-accessible and does not require high attack complexity.

What is the likely impact if exploitation succeeds?

This is a stored XSS issue, meaning attacker-supplied content can be retained and later executed in a user's browser. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability, with scope changed.

Which plugin versions are affected?

TI WooCommerce Wishlist versions through 2.14.0 are affected. The available data does not identify a fixed version.

CVE-2026-120855: WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which plugin versions are affected?