{"id":"CVE-2026-114701","kind":"vulnerability","aliases":["CVE-2026-114701"],"related":[],"title":"Waitlist WooCommerce plugin: stored XSS through 2.9.1 in back-in-stock notifier","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) waitlist-woocommerce allows Stored XSS.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.9.1.","summary":"The Waitlist WooCommerce plugin (back-in-stock notifier) does not neutralize input before rendering it in pages, which allows stored cross-site scripting. An attacker who can submit data the plugin stores can run script in the browser of other users, including store admins who view it.","severity":"medium","cvss":6.5,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","waitlist-woocommerce","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress plugin `waitlist-woocommerce` is installed and read its version in the plugin header or `readme.txt`\n- unknown for other checks; the sources do not say which input fields or pages are affected","fix":"- Update the Waitlist WooCommerce plugin to a version later than `2.9.1`\n- unknown whether a fixed version number is published; the sources do not say","status":"open","published_at":"2026-10-22T09:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:47:27+00:00","updated_at":"2026-10-25T03:47:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Waitlist WooCommerce plugin to a version later than `2.9.1`\n- unknown whether a fixed version number is published; the sources do not say","reach":"internet","title":"Waitlist WooCommerce plugin: stored XSS through 2.9.1 in back-in-stock notifier","impact":"medium","summary":"The Waitlist WooCommerce plugin (back-in-stock notifier) does not neutralize input before rendering it in pages, which allows stored cross-site scripting. An attacker who can submit data the plugin stores can run script in the browser of other users, including store admins who view it.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","waitlist-woocommerce"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in admin browsers, stealing sessions or actions","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114701 for the affected input fields, the authentication needed, and the fixed version.","how_to_check":"- Check whether the WordPress plugin `waitlist-woocommerce` is installed and read its version in the plugin header or `readme.txt`\n- unknown for other checks; the sources do not say which input fields or pages are affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Waitlist WooCommerce (back in stock notifier) plugin at version 2.9.1 or earlier are exposed, since the flaw is in how the plugin stores and renders submitted input. Stores that do not use this plugin can skip it. The sources do not say which submission forms are reachable without an account.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3383,"output_tokens":632,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114701':16A,19A '-2026':15A,18A '2.9.1':7A,112C 'admin':71B 'affect':102C 'allow':45B,98C 'attack':52B 'back':10A,31B,91C,105C 'back-in-stock':9A,30B 'browser':65B 'cross':48B,83C 'cross-sit':47B,82C 'cve':14A,17A 'data':56B 'generat':81C 'improp':74C 'includ':69B 'input':38B,77C 'issu':101C 'n/a':110C 'neutral':37B,75C 'notifi':13A,34B,94C,108C 'packag':20B 'page':43B,80C 'plugin':3A,29B,58B 'render':40B 'run':61B 'script':50B,62B,85C 'site':49B,84C 'stock':12A,33B,93C,107C 'store':4A,46B,59B,70B,99C 'submit':55B 'user':68B 'view':73B 'vulner':86C 'waitlist':1A,22B,27B,89C,96C,103C 'waitlist-woocommerc':21B,95C 'web':79C 'woocommerc':2A,23B,24B,28B,90C,97C,104C 'wordpress':25B 'xootix':88C 'xss':5A 'xss.this':100C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Waitlist WooCommerce (back in stock notifier) plugin at version 2.9.1 or earlier are exposed, since the flaw is in how the plugin stores and renders submitted input. Stores that do not use this plugin can skip it. The sources do not say which submission forms are reachable without an account.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114701","severity":null,"published_at":"2026-10-22T09:17:15+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114701","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114701","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}