CVE-2026-77188: Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. They can place a malicious shortcode attribute in content they are permitted to save.

Q: Are sites protected by WordPress contributor content filtering?

No. The wp_kses_post filter applied when a Contributor saves a post does not block this payload, because the malicious value is in a shortcode attribute rather than HTML and is materialized when the shortcode is rendered.

Q: When does the injected script execute?

The script executes when a user accesses a page containing the attacker-injected shortcode and WordPress expands that shortcode. This can affect users who view the compromised page, not only the attacker.

Q: What versions are affected?

All versions of the plugin through 2.9.1, including 2.9.1, are affected.

Published Oct 28, 2026

Updated

The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpksespost filter applied on contributor post save does not prevent this vulnerability because shortcode attribute values are not HTML and pass through kses unchanged; the payload is materialized only at render time when the shortcode is expanded.

Affected Software

1 affected component

Villatheme Waitlist Woocommerce (Back in stock notifier)<=2.9.1

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. They can place a malicious shortcode attribute in content they are permitted to save.

Are sites protected by WordPress contributor content filtering?

No. The wp_kses_post filter applied when a Contributor saves a post does not block this payload, because the malicious value is in a shortcode attribute rather than HTML and is materialized when the shortcode is rendered.

When does the injected script execute?

The script executes when a user accesses a page containing the attacker-injected shortcode and WordPress expands that shortcode. This can affect users who view the compromised page, not only the attacker.

What versions are affected?

All versions of the plugin through 2.9.1, including 2.9.1, are affected.

CVE-2026-77188: Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are sites protected by WordPress contributor content filtering?

When does the injected script execute?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are sites protected by WordPress contributor content filtering?

When does the injected script execute?

What versions are affected?