CVE-2026-125746: WordPress Back In Stock Notifier for WooCommerce plugin <= 7.5.2 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
back-in-stock-notifier-for-woocommerceto a version that resolves this vulnerability.Fixed in 7.5.3
Event History
Frequently Asked Questions
Which plugin versions are affected?
The issue affects Back In Stock Notifier for WooCommerce versions through 7.5.2. The available data does not identify the first fixed version.
Can this be exploited remotely without an account or user interaction?
The supplied CVSS vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required. This indicates the vulnerable functionality may be reachable remotely without authentication.
What is the likely impact if exploitation succeeds?
The vulnerability is classified as basic cross-site scripting/content injection with low confidentiality impact and no stated integrity or availability impact. Successful exploitation could expose limited information in the affected web-page context.