{"id":"CVE-2026-112199","kind":"vulnerability","aliases":["CVE-2026-112199"],"related":[],"title":"YITH WooCommerce Wishlist: stored XSS through 4.18.1 lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.","summary":"YITH WooCommerce Wishlist, a WordPress plugin for WooCommerce stores, fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can store malicious input can run JavaScript in other users' browsers, such as administrators' sessions.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woocommerce","wordpress","yith-woocommerce-wishlist"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the YITH WooCommerce Wishlist plugin (yith-woocommerce-wishlist) in the WordPress admin under Plugins, or with `wp plugin get yith-woocommerce-wishlist --field=version`\n- Confirm whether the reported version range covers your installed version (affected: through `4.18.1`)","fix":"- Update YITH WooCommerce Wishlist to a version later than `4.18.1`; the fixed version is unknown from the sources\n- Check the vendor's changelog for the patched release before relying on a specific version number","status":"open","published_at":"2026-10-19T13:16:57+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:57:04+00:00","updated_at":"2026-10-25T03:57:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update YITH WooCommerce Wishlist to a version later than `4.18.1`; the fixed version is unknown from the sources\n- Check the vendor's changelog for the patched release before relying on a specific version number","reach":"internet","title":"YITH WooCommerce Wishlist: stored XSS through 4.18.1 lets attackers run scripts","impact":"medium","summary":"YITH WooCommerce Wishlist, a WordPress plugin for WooCommerce stores, fails to neutralize input before generating web pages, allowing stored cross-site scripting. An attacker who can store malicious input can run JavaScript in other users' browsers, such as administrators' sessions.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yith-woocommerce-wishlist"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker scripts run in other users' browsers, including admins","analyst_note":"Check the NVD entry and YITH advisory for the fixed version, the required privilege to store input, and whether the injection point needs user interaction.","how_to_check":"- Check the installed version of the YITH WooCommerce Wishlist plugin (yith-woocommerce-wishlist) in the WordPress admin under Plugins, or with `wp plugin get yith-woocommerce-wishlist --field=version`\n- Confirm whether the reported version range covers your installed version (affected: through `4.18.1`)","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running YITH WooCommerce Wishlist at version 4.18.1 or earlier are exposed. The risk is highest where wishlist content is entered or displayed to other users, including administrators. Sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":3332,"output_tokens":656,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112199':14A,17A '-2026':13A,16A '4.18.1':7A,99C 'administr':64B 'affect':92C 'allow':42B,88C 'attack':9A,49B 'browser':61B 'cross':45B,75C 'cross-sit':44B,74C 'cve':12A,15A 'fail':34B 'generat':39B,73C 'improp':66C 'input':37B,54B,69C 'issu':91C 'javascript':57B 'let':8A 'malici':53B 'n/a':97C 'neutral':36B,67C 'packag':18B 'page':41B,72C 'plugin':30B 'run':10A,56B 'script':11A,47B,77C 'session':65B 'site':46B,76C 'store':4A,33B,43B,52B,89C 'user':60B 'vulner':78C 'web':40B,71C 'wishlist':3A,24B,27B,83C,87C,95C 'woocommerc':2A,19B,23B,26B,32B,82C,86C,94C 'wordpress':20B,29B 'xss':5A 'xss.this':90C 'yith':1A,22B,25B,80C,81C,85C,93C 'yith-woocommerce-wishlist':21B,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running YITH WooCommerce Wishlist at version 4.18.1 or earlier are exposed. The risk is highest where wishlist content is entered or displayed to other users, including administrators. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112199","severity":null,"published_at":"2026-10-19T13:16:57+00:00","modified_at":"2026-10-19T19:17:26+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}