Live › vulnerability › CVE-2026-112199
Go to dashboardYITH WooCommerce Wishlist, a WordPress plugin for WooCommerce stores, fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can store malicious input can run JavaScript in other users' browsers, such as administrators' sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running YITH WooCommerce Wishlist at version 4.18.1 or earlier are exposed. The risk is highest where wishlist content is entered or displayed to other users, including administrators. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get yith-woocommerce-wishlist --field=version4.18.1)4.18.1; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-112199")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.