CVE-2026-121516 · Package
NO FIX YET · SEE WHAT TO DO
The QODE Wishlist for WooCommerce WordPress plugin (version 1.2.9 and earlier) stores attacker-supplied script in wishlist data that is shown to other visitors. An unauthenticated attacker can get a script to run in the browser of a victim who opens a crafted share link and clicks an injected title.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the QODE Wishlist for WooCommerce plugin up to and including 1.2.9 with a public wishlist page are exposed. The attack needs an administrator to act on the injected content, so sites where the plugin is not installed or the wishlist is not public can skip it. The sources do not say whether a fixed version exists.
Not affected if plugin-not-installed, plugin-version-above-1.2.9
Who cares qode-wishlist, woocommerce, wordpress
1.2.9 and earlier are listed as affected./wishlist/ page.The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.