CVE-2026-97268 in Wishlist Plugin
Summary
by MITRE • 10/01/2026
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an unauthenticated cross-site scripting flaw within the Premmerce Wishlist plugin for WordPress, affecting versions up to and including 1.1.13, represents a significant security risk due to its lack of authentication requirements. This specific characteristic allows any internet user, without needing valid credentials or prior interaction with the site's administrative functions, to inject malicious scripts into web pages viewed by other users. The core technical flaw typically stems from insufficient input validation and output encoding when handling data submitted via HTTP requests, such as those made through AJAX endpoints or form submissions related to wishlist management features like adding items, removing items, or updating wishlists. When the application processes these inputs without properly sanitizing special characters or escaping them before rendering in HTML context, it creates an entry point for script injection. This aligns directly with CWE-79, which classifies improper neutralization of input during web page generation as a primary cause of cross-site scripting vulnerabilities.
From an operational perspective, the impact of this vulnerability is severe because it enables attackers to execute arbitrary JavaScript code in the context of the victim's browser session on the targeted WordPress site. Since the attack does not require authentication, the barrier for exploitation is exceptionally low, allowing automated scanning tools and opportunistic attackers to target vulnerable sites at scale. Successful exploitation can lead to several detrimental outcomes including session hijacking where an attacker steals cookies or tokens associated with user sessions, potentially gaining unauthorized access to accounts if secure cookie flags are not properly configured. It also facilitates phishing attacks by manipulating the DOM to display fake login forms that capture credentials, and it allows for defacement of the website's appearance or redirection of users to malicious domains hosting malware. Furthermore, in e-commerce environments powered by WooCommerce, this could be leveraged to manipulate shopping cart contents or wishlist data client-side, undermining user trust and potentially causing financial loss if combined with other vulnerabilities like CSRF.
The exploitation vector often involves crafting a specially crafted URL or POST request that includes the malicious script payload within parameters related to wishlist operations. For instance, an attacker might embed JavaScript code in a product title or description field that gets reflected back into the page when another user views their wishlist containing that item. Alternatively, stored XSS variants could occur if the input is saved to the database and later rendered without proper encoding, affecting all users who view the affected content. This behavior corresponds with MITRE ATT&CK technique T1059, specifically sub-techniques involving command and script interpreters like JavaScript in a browser context, which are commonly used for initial access or persistence through bookmarklets or injected scripts that execute upon page load.
To mitigate this vulnerability, immediate action is required to update the Premmerce Wishlist plugin to version 1.1.14 or later where these input validation issues have been addressed by developers implementing robust sanitization and output encoding practices. For sites unable to upgrade immediately due to compatibility constraints, temporary mitigations include deploying a Web Application Firewall (WAF) with rules designed to detect and block common XSS payloads in HTTP requests targeting wishlist endpoints. Additionally, ensuring that Content Security Policy headers are implemented can help mitigate the impact of any successful injection by restricting the sources from which scripts can be loaded or executed. Developers should also review their codebase for similar patterns across other plugins, applying principles such as least privilege and strict input validation to prevent future occurrences of CWE-79 vulnerabilities in WordPress ecosystems.