{"id":"CVE-2026-119517","kind":"vulnerability","aliases":["CVE-2026-119517"],"related":[],"title":"Catna Woo Name Your Price plugin: reflected XSS through 2.0.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3.","summary":"The Catna – Woo Name Your Price and Offers WordPress plugin by VillaTheme does not neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can get a victim's browser to run script in the context of the store site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"catna-woo-name-your-price-and-offers","fixed":["2.0.4"],"affected":"<= 2.0.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["catna-woo-name-your-price-and-offers","package","reflected-xss","woocommerce","wordpress"],"not_affected_if":["plugin-inactive","plugin-not-installed","version-2.0.4-or-later"],"how_to_check":"WordPress admin > Plugins: find 'Catna – Woo Name Your Price and Offers'; vulnerable if version is 2.0.3 or lower. Or run: wp plugin list --name=catna-woo-name-your-price-and-offers --fields=name,status,version","fix":"Update to 2.0.4 or later (released 2026-11-07; its changelog lists XSS escaping fixes but does not name this CVE)","status":"open","published_at":"2026-11-13T15:17:32+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:40+00:00","updated_at":"2026-11-13T15:50:50+00:00","category":"package","confidence":0.65,"triage":{"at":"2026-11-13T15:48:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Catna Woo Name Your Price plugin: reflected XSS through 2.0.3","impact":"medium","summary":"The Catna – Woo Name Your Price and Offers WordPress plugin by VillaTheme does not neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can get a victim's browser to run script in the context of the store site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","catna-woo-name-your-price-and-offers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs script in victims' browsers on the store site","analyst_note":"Confirm the fixed version and vulnerable parameter from the VillaTheme advisory or the WPScan/Wordfence entry for CVE-2026-119517.","how_to_check":"- Check the installed version of the plugin `catna-woo-name-your-price-and-offers` in the WordPress admin plugin list\n- Confirm whether the plugin is active on the store","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Catna – Woo Name Your Price and Offers plugin up to version 2.0.3 are potentially exposed. The sources do not state a fixed version or the exact vulnerable input, so unknown whether a specific setting or page is required.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4580,"output_tokens":565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vulnerable parameter from the VillaTheme advisory or the WPScan/Wordfence entry for CVE-2026-119517.","search":"'-119517':13A,16A '-2026':12A,15A '2.0.3':10A,127C 'affect':116C 'allow':112C 'and':23A 'attack':65B 'browser':71B 'catna':1A,18A,26B,40B,97C,105C,117C 'catna-woo-name-your-price-and-off':25B,104C 'catna-woo-name-your-price-and-offers':17A 'context':77B 'cross':61B,91C 'cross-sit':60B,90C 'cve':11A,14A 'enabl':58B 'generat':56B,89C 'get':67B 'improp':82C 'input':54B,85C 'issu':115C 'n/a':125C 'name':3A,20A,28B,42B,99C,107C,119C 'neutral':53B,83C 'offer':32B,46B,103C,111C,123C 'offers':24A 'packag':33B 'page':57B,88C 'plugin':6A,48B 'price':5A,22A,30B,44B,101C,109C,121C 'reflect':7A,35B,59B,113C 'reflected-xss':34B 'run':73B 'script':63B,74B,93C 'site':62B,81B,92C 'store':80B 'victim':69B 'villathem':50B,96C 'vulner':94C 'web':87C 'woo':2A,19A,27B,41B,98C,106C,118C 'woocommerc':37B 'wordpress':38B,47B 'xss':8A,36B 'xss.this':114C 'your':21A","nicknames":[],"mitigations":[],"who_affected":"WooCommerce stores running the free Catna – Woo Name Your Price and Offers plugin (VillaTheme) at version 2.0.3 or lower. A victim must follow a crafted link (reflected XSS, no login needed by the attacker). The exact vulnerable parameter is not published in the sources I could read. Sites without the plugin, or on 2.0.4+, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["catnawoonameyourpriceandoffers"],"ptokens":["and","catna","name","offers","price","woo","your"],"labels":["catnawoonameyourpriceandoffers","high","package","reflectedxss","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-119517':13A,16A '-2026':12A,15A '2.0.3':10A 'and':23A 'catna':1A,18A 'catna-woo-name-your-price-and-offers':17A 'cve':11A,14A 'name':3A,20A 'offers':24A 'plugin':6A 'price':5A,22A 'reflect':7A 'woo':2A,19A 'xss':8A 'your':21A","search_b":"'attack':65B 'browser':71B 'catna':26B,40B 'catna-woo-name-your-price-and-off':25B 'context':77B 'cross':61B 'cross-sit':60B 'enabl':58B 'generat':56B 'get':67B 'input':54B 'name':28B,42B 'neutral':53B 'offer':32B,46B 'packag':33B 'page':57B 'plugin':48B 'price':30B,44B 'reflect':35B,59B 'reflected-xss':34B 'run':73B 'script':63B,74B 'site':62B,81B 'store':80B 'victim':69B 'villathem':50B 'woo':27B,41B 'woocommerc':37B 'wordpress':38B,47B 'xss':36B","search_c":"'2.0.3':127C 'affect':116C 'allow':112C 'catna':97C,105C,117C 'catna-woo-name-your-price-and-off':104C 'cross':91C 'cross-sit':90C 'generat':89C 'improp':82C 'input':85C 'issu':115C 'n/a':125C 'name':99C,107C,119C 'neutral':83C 'offer':103C,111C,123C 'page':88C 'price':101C,109C,121C 'reflect':113C 'script':93C 'site':92C 'villathem':96C 'vulner':94C 'web':87C 'woo':98C,106C,118C 'xss.this':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119517","severity":null,"published_at":"2026-11-13T15:17:32+00:00","modified_at":"2026-11-13T15:17:32+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119517:3898","url":"https://wordpress.org/plugins/catna-woo-name-your-price-and-offers/","severity":null,"published_at":"2026-11-13T15:50:50+00:00","modified_at":"2026-11-13T15:50:50+00:00","first_seen_at":"2026-11-13T15:50:50+00:00","fetched_at":"2026-11-13T15:50:50+00:00","note":"NVD says <=2.0.3 reflected XSS. wordpress.org changelog 2.0.4 (2026-11-07) fixes XSS escaping in Instant Smart Offer cart values and product names; it does not cite the CVE, so the fix is not marked verified. Vulnerable parameter not found; no Wordfence/WPScan/Patchstack page seen. No exploitation reported.","cites":["https://wordpress.org/plugins/catna-woo-name-your-price-and-offers/"]}],"documents":[{"id":147279,"url":"https://wordpress.org/plugins/catna-woo-name-your-price-and-offers/","title":"Catna – Woo Name Your Price and Offers (wordpress.org, changelog 2.0.4)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}