CVE-2026-120855 in TI Wishlist Plugin
Summary
by MITRE • 11/09/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/09/2026
The identified vulnerability represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this flaw manifests within the TemplateInvaders TI WooCommerce Wishlist plugin for WordPress, affecting versions ranging from its initial release through version 2.14.0. The core technical issue lies in the application's failure to adequately sanitize user-supplied input before it is rendered back into the web page context. This lack of proper encoding or validation allows an attacker to inject malicious client-side scripts that are then executed by the victim's browser when viewing the affected content.
In this specific implementation, the vulnerability is classified as Stored XSS rather than Reflected XSS. This distinction is critical because it implies that the malicious payload is not merely processed and discarded in a single HTTP request-response cycle but is instead permanently stored on the target server within the application's database or file system. When other users subsequently access the compromised page or data, their browsers retrieve and execute the injected script automatically. The attack vector typically involves an attacker submitting crafted input through any field that accepts user-generated content without sufficient validation, such as product review sections, wishlist descriptions, comment fields, or profile information areas within the WooCommerce ecosystem.
The operational impact of this vulnerability is severe due to its persistent nature. Unlike reflected XSS which requires social engineering tricks like phishing links to trigger a single execution, stored XSS ensures that every user who views the infected content becomes a potential victim without any additional interaction from the attacker beyond the initial injection. This significantly increases the attack surface and the likelihood of successful exploitation. The consequences can include session hijacking, where attackers steal administrative cookies or authentication tokens to gain unauthorized access to WordPress admin panels; defacement of the website by altering displayed content; redirection of users to malicious sites hosting malware or phishing pages; and logging of sensitive user data such as keystrokes, credit card numbers, or personal information entered on the site.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It also maps to specific techniques within the MITRE ATT&CK framework for web applications, particularly T1059.007 which covers JavaScript execution in browsers and potentially T1189 if used as part of a broader campaign involving drive-by downloads or credential harvesting. The persistence mechanism inherent in stored XSS corresponds to behaviors often seen in advanced persistent threats where maintaining long-term access is a primary objective.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The most effective solution is for administrators to upgrade the TI WooCommerce Wishlist plugin to version 2.14.1 or later, where this input validation flaw has been corrected by implementing robust output encoding functions such as esc_html_e() or wp_kses_post() in PHP code before rendering user data into HTML contexts. For organizations unable to immediately patch due to compatibility concerns, temporary mitigations may include restricting the capabilities of users who can submit content that is displayed publicly, thereby limiting potential attackers to low-privilege accounts only. Additionally, implementing a Web Application Firewall with rulesets tuned for XSS detection can provide an additional layer of defense by blocking requests containing known malicious script patterns before they reach the application logic. Regular security audits and code reviews focusing on input handling are essential to prevent similar vulnerabilities in future updates or custom integrations within the WordPress environment.