CVE-2026-112199 in WooCommerce Wishlist Plugin
Summary
by MITRE • 10/19/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests as a Stored XSS within the YITH WooCommerce Wishlist plugin for WordPress, affecting versions ranging from n/a through 4.18.1. Unlike reflected XSS attacks where malicious scripts are executed via manipulated URLs, stored vulnerabilities persist on the target server because user-supplied input is saved in a database or other persistent storage mechanism without adequate sanitization. When this tainted data is subsequently retrieved and rendered to users by the web application, it executes as active script code within the victim's browser context, leading to severe security implications for both end-users and site administrators.
The technical root cause lies in the insufficient validation and encoding of user input fields associated with wishlist functionality. Attackers can inject malicious JavaScript payloads into these inputs during normal interaction with the plugin, such as adding items to a wishlist or modifying wish list details. Because the application fails to properly neutralize special characters that have meaning in HTML and JavaScript contexts, the injected script is stored intact on the server side. Consequently, any user who views the affected page containing this data will inadvertently execute the malicious code within their own browser session. This mechanism allows for persistent compromise of client-side security controls without requiring further interaction from the attacker after the initial injection.
From an operational impact perspective, a successful exploitation of this stored XSS vulnerability can lead to significant consequences including account takeover, session hijacking, and data exfiltration. An attacker could steal administrative or user cookies, thereby impersonating legitimate users and gaining unauthorized access to sensitive accounts within the WooCommerce environment. Furthermore, the malicious script can perform actions on behalf of the victim, such as modifying wishlist contents, making purchases, or defacing the website content by altering displayed text. In more sophisticated scenarios, the attacker might deploy keyloggers to capture credentials entered into other forms on the site or redirect users to phishing pages designed to harvest sensitive information. The persistent nature of stored XSS means that every visitor to the affected page becomes a potential victim, amplifying the scope and severity of the attack significantly compared to one-time exploits.
This vulnerability aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as Cross-site Scripting (XSS). It also maps closely to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within a browser environment. The attack vector typically involves the attacker crafting specific input payloads that bypass existing filters or rely on the application's failure to encode output correctly before rendering it in an HTML context. This lack of defense-in-depth allows simple script tags and event handlers to execute freely, undermining the trust model between the web server and its clients.
To mitigate this vulnerability, immediate action is required by updating the YITH WooCommerce Wishlist plugin to a version later than 4.18.1 where these input handling issues have been addressed through proper sanitization and output encoding practices. Administrators should ensure that all plugins are kept up-to-date with security patches released by their vendors. Additionally, implementing Content Security Policy headers can help mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts can be loaded and executed. Input validation strategies should also be reinforced at both the client and server sides to reject or properly encode special characters before they are processed or stored. Regular security audits and penetration testing focused on web application logic will further assist in identifying similar flaws across other components of the e-commerce infrastructure, ensuring a robust defense against injection-based attacks.