{"id":"CVE-2026-120855","kind":"vulnerability","aliases":["CVE-2026-120855"],"related":[],"title":"TI WooCommerce Wishlist: stored XSS lets page content run in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.","summary":"The TI WooCommerce Wishlist WordPress plugin does not neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can store malicious content can run script in the browsers of other users who view the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ti-woocommerce-wishlist","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","ti-woocommerce-wishlist","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `ti-woocommerce-wishlist` plugin in the WordPress admin plugin list.\n- Compare it against the affected range: from n/a through `2.14.0`.","fix":"- TI WooCommerce Wishlist: unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:43+00:00","updated_at":"2026-11-09T11:26:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:43Z","model":"claude-haiku-5-5","output":{"fix":"- TI WooCommerce Wishlist: unknown; the sources do not name a fixed version.","reach":"internet","title":"TI WooCommerce Wishlist: stored XSS lets page content run in visitors' browsers","impact":"medium","summary":"The TI WooCommerce Wishlist WordPress plugin does not neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can store malicious content can run script in the browsers of other users who view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","ti-woocommerce-wishlist"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers on the store","analyst_note":"Confirm the fixed version and required privilege from the NVD entry or the plugin vendor's changelog; the description gives only 'through 2.14.0'.","how_to_check":"- Check the installed version of the `ti-woocommerce-wishlist` plugin in the WordPress admin plugin list.\n- Compare it against the affected range: from n/a through `2.14.0`.","plain_action":"","product_name":"ti-woocommerce-wishlist","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the TI WooCommerce Wishlist plugin up to and including 2.14.0 are affected. The sources do not say which user roles can store the malicious input, so unknown whether anonymous visitors can exploit it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000756,"input_tokens":4565,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120855':15A,18A '-2026':14A,17A '2.14.0':103C 'affect':68B,96C 'allow':43B,92C 'attack':50B 'browser':12A,61B 'content':8A,55B 'cross':46B,79C 'cross-sit':45B,78C 'cve':13A,16A 'generat':41B,77C 'improp':70C 'input':39B,73C 'issu':95C 'let':6A 'malici':54B 'n/a':101C 'neutral':38B,71C 'packag':23B 'page':7A,42B,69B,76C 'plugin':35B 'run':9A,57B 'script':48B,58B,81C 'site':47B,80C 'store':4A,44B,53B,93C 'templateinvad':84C 'ti':1A,20A,25B,31B,85C,89C,97C 'ti-woocommerce-wishlist':19A,24B,88C 'user':64B 'view':66B 'visitor':11A 'vulner':82C 'web':75C 'wishlist':3A,22A,27B,33B,87C,91C,99C 'woocommerc':2A,26B,28B,32B,86C,90C,98C 'woocommerce':21A 'wordpress':29B,34B 'xss':5A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the TI WooCommerce Wishlist plugin up to and including 2.14.0 are affected. The sources do not say which user roles can store the malicious input, so unknown whether anonymous visitors can exploit it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["tiwoocommercewishlist"],"ptokens":["ti","wishlist","woocommerce"],"labels":["medium","package","tiwoocommercewishlist","vendor","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-120855':15A,18A '-2026':14A,17A 'browser':12A 'content':8A 'cve':13A,16A 'let':6A 'page':7A 'run':9A 'store':4A 'ti':1A,20A 'ti-woocommerce-wishlist':19A 'visitor':11A 'wishlist':3A,22A 'woocommerc':2A 'woocommerce':21A 'xss':5A","search_b":"'affect':68B 'allow':43B 'attack':50B 'browser':61B 'content':55B 'cross':46B 'cross-sit':45B 'generat':41B 'input':39B 'malici':54B 'neutral':38B 'packag':23B 'page':42B,69B 'plugin':35B 'run':57B 'script':48B,58B 'site':47B 'store':44B,53B 'ti':25B,31B 'ti-woocommerce-wishlist':24B 'user':64B 'view':66B 'wishlist':27B,33B 'woocommerc':26B,28B,32B 'wordpress':29B,34B","search_c":"'2.14.0':103C 'affect':96C 'allow':92C 'cross':79C 'cross-sit':78C 'generat':77C 'improp':70C 'input':73C 'issu':95C 'n/a':101C 'neutral':71C 'page':76C 'script':81C 'site':80C 'store':93C 'templateinvad':84C 'ti':85C,89C,97C 'ti-woocommerce-wishlist':88C 'vulner':82C 'web':75C 'wishlist':87C,91C,99C 'woocommerc':86C,90C,98C 'xss.this':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120855","severity":null,"published_at":"2026-11-09T11:17:22+00:00","modified_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}