Live › vulnerability › CVE-2026-114701
Go to dashboardThe Waitlist WooCommerce plugin (back-in-stock notifier) does not neutralize input before rendering it in pages, which allows stored cross-site scripting. An attacker who can submit data the plugin stores can run script in the browser of other users, including store admins who view it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Waitlist WooCommerce (back in stock notifier) plugin at version 2.9.1 or earlier are exposed, since the flaw is in how the plugin stores and renders submitted input. Stores that do not use this plugin can skip it. The sources do not say which submission forms are reachable without an account.
No product ranges from the sources yet.
waitlist-woocommerce is installed and read its version in the plugin header or readme.txt2.9.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) waitlist-woocommerce allows Stored XSS.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.9.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114701")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.