{"id":"CVE-2026-121516","kind":"vulnerability","aliases":["CVE-2026-121516"],"related":[],"title":"QODE Wishlist for WooCommerce WordPress plugin: stored cross-site scripting via guest wishlist","description":"The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.","summary":"The QODE Wishlist for WooCommerce WordPress plugin (version 1.2.9 and earlier) stores attacker-supplied script in wishlist data that is shown to other visitors. An unauthenticated attacker can get a script to run in the browser of a victim who opens a crafted share link and clicks an injected title.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","qode-wishlist","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.2.9"],"how_to_check":"- Check the installed version of the QODE Wishlist for WooCommerce plugin in the WordPress plugins screen; versions `1.2.9` and earlier are listed as affected.\n- Confirm whether the plugin is active on any site that has a public `/wishlist/` page.","fix":"- QODE Wishlist for WooCommerce: unknown (the sources do not name a fixed version)","status":"open","published_at":"2026-11-07T04:17:18+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","triaged_at":"2026-11-07T04:47:54+00:00","updated_at":"2026-11-07T04:47:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T04:47:54Z","model":"claude-haiku-5-5","output":{"fix":"- QODE Wishlist for WooCommerce: unknown (the sources do not name a fixed version)","reach":"internet","title":"QODE Wishlist for WooCommerce WordPress plugin: stored cross-site scripting via guest wishlist","impact":"medium","summary":"The QODE Wishlist for WooCommerce WordPress plugin (version 1.2.9 and earlier) stores attacker-supplied script in wishlist data that is shown to other visitors. An unauthenticated attacker can get a script to run in the browser of a victim who opens a crafted share link and clicks an injected title.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","qode-wishlist"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in an administrator's browser on the site","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for a fixed version after 1.2.9.","how_to_check":"- Check the installed version of the QODE Wishlist for WooCommerce plugin in the WordPress plugins screen; versions `1.2.9` and earlier are listed as affected.\n- Confirm whether the plugin is active on any site that has a public `/wishlist/` page.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.2.9"],"who_is_affected":"Sites running the QODE Wishlist for WooCommerce plugin up to and including 1.2.9 with a public wishlist page are exposed. The attack needs an administrator to act on the injected content, so sites where the plugin is not installed or the wishlist is not public can skip it. The sources do not say whether a fixed version exists.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4426,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121516':17A,20A '-2026':16A,19A '/wishlist':162C '1.2.9':35B,110C 'access':139C 'action':201C 'addit':198C 'administr':204C 'arbitrari':128C 'attack':40B,54B,125C,166C,206C 'attacker-suppli':39B 'browser':63B 'cannot':207C 'click':74B,191C 'control':167C 'craft':70B,187C 'cross':9A,91C 'cross-sit':8A,90C 'cve':15A,18A 'data':45B 'due':111C 'earlier':37B 'emit':156C 'escap':118C 'execut':135C 'exploit':145C,197C 'get':56B 'guest':13A,100C,147C 'includ':109C 'inject':76B,127C,141C,193C 'input':114C 'insuffici':113C 'item':101C 'key':170C 'link':72B,195C 'make':120C 'mean':171C 'nonc':153C 'open':68B,185C 'output':117C 'packag':21B 'page':132C,142C,163C 'paramet':102C 'payload':173C 'plugin':6A,33B,83C 'possibl':122C 'public':155C 'qode':1A,23B,28B,79C,96C 'qode-wishlist':22B 'requir':150C,181C,199C 'rest':152C 'run':60B 'sanit':115C 'script':11A,42B,58B,93C,130C 'share':71B,188C 'shown':48B 'site':10A,92C,177C 'site-wid':176C 'store':7A,38B,89C,175C 'success':196C 'suppli':41B 'titl':77B,194C 'transient':169C 'trigger':208C 'unauthent':53B,124C,158C 'url':189C 'user':138C 'version':34B,105C 'via':12A,94C 'victim':66B,183C 'visitor':51B,159C 'vulner':87C,210C 'web':129C 'whenev':136C 'wide':178C 'wishlist':2A,14A,24B,29B,44B,80C,97C 'woocommerc':4A,25B,31B,82C,99C 'wordpress':5A,26B,32B,85C 'wp':151C","nicknames":[],"mitigations":[],"who_affected":"Sites running the QODE Wishlist for WooCommerce plugin up to and including 1.2.9 with a public wishlist page are exposed. The attack needs an administrator to act on the injected content, so sites where the plugin is not installed or the wishlist is not public can skip it. The sources do not say whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","qodewishlist","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-121516':17A,20A '-2026':16A,19A 'cross':9A 'cross-sit':8A 'cve':15A,18A 'guest':13A 'plugin':6A 'qode':1A 'script':11A 'site':10A 'store':7A 'via':12A 'wishlist':2A,14A 'woocommerc':4A 'wordpress':5A","search_b":"'1.2.9':35B 'attack':40B,54B 'attacker-suppli':39B 'browser':63B 'click':74B 'craft':70B 'data':45B 'earlier':37B 'get':56B 'inject':76B 'link':72B 'open':68B 'packag':21B 'plugin':33B 'qode':23B,28B 'qode-wishlist':22B 'run':60B 'script':42B,58B 'share':71B 'shown':48B 'store':38B 'suppli':41B 'titl':77B 'unauthent':53B 'version':34B 'victim':66B 'visitor':51B 'wishlist':24B,29B,44B 'woocommerc':25B,31B 'wordpress':26B,32B","search_c":"'/wishlist':162C '1.2.9':110C 'access':139C 'action':201C 'addit':198C 'administr':204C 'arbitrari':128C 'attack':125C,166C,206C 'cannot':207C 'click':191C 'control':167C 'craft':187C 'cross':91C 'cross-sit':90C 'due':111C 'emit':156C 'escap':118C 'execut':135C 'exploit':145C,197C 'guest':100C,147C 'includ':109C 'inject':127C,141C,193C 'input':114C 'insuffici':113C 'item':101C 'key':170C 'link':195C 'make':120C 'mean':171C 'nonc':153C 'open':185C 'output':117C 'page':132C,142C,163C 'paramet':102C 'payload':173C 'plugin':83C 'possibl':122C 'public':155C 'qode':79C,96C 'requir':150C,181C,199C 'rest':152C 'sanit':115C 'script':93C,130C 'share':188C 'site':92C,177C 'site-wid':176C 'store':89C,175C 'success':196C 'titl':194C 'transient':169C 'trigger':208C 'unauthent':124C,158C 'url':189C 'user':138C 'version':105C 'via':94C 'victim':183C 'visitor':159C 'vulner':87C,210C 'web':129C 'whenev':136C 'wide':178C 'wishlist':80C,97C 'woocommerc':82C,99C 'wordpress':85C 'wp':151C","first_public_at":"2026-11-07T04:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121516","severity":null,"published_at":"2026-11-07T04:17:18+00:00","modified_at":"2026-11-07T04:17:18+00:00","first_seen_at":"2026-11-07T04:45:47+00:00","fetched_at":"2026-11-07T04:45:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}