CVE-2026-97273: WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Premmerce Wishlist for WooCommerceto a version that resolves this vulnerability.Fixed in 1.1.15
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
Premmerce Wishlist for WooCommerce versions 1.1.13 and earlier are affected. The provided data does not state whether any particular WordPress or WooCommerce configuration changes exposure.
What is the potential impact of successful exploitation?
Successful XSS can affect confidentiality, integrity, and availability at a low impact level, and the scope may extend beyond the vulnerable component. The CVSS vector rates the issue as network-accessible with low attack complexity.