CVE-2026-97268: WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Premmerce Wishlist for WooCommerceto a version that resolves this vulnerability.Fixed in 1.1.15
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation still requires user interaction, as reflected by the UI:R attack vector.
Which installations are affected?
Premmerce Wishlist for WooCommerce versions 1.1.13 and earlier are affected. The provided information does not state whether any particular default configuration or feature setting is required.
What is the potential impact?
Successful exploitation can allow cross-site scripting in a victim's browser. The listed impact includes low confidentiality, integrity, and availability effects, and the scope is changed.