---
id: "CVE-2026-121516"
page: "https://infrastack.ai/live/CVE-2026-121516"
kind: "vulnerability"
aliases: ["CVE-2026-121516"]
title: "QODE Wishlist for WooCommerce WordPress plugin: stored cross-site scripting via guest wishlist"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "qode-wishlist", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-above-1.2.9"]
published_at: "2026-11-07T04:17:18+00:00"
first_seen_at: "2026-11-07T04:45:47+00:00"
updated_at: "2026-11-07T04:47:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121516", "first_seen_at": "2026-11-07T04:45:47+00:00"}]
exploit_sources: []
---

# QODE Wishlist for WooCommerce WordPress plugin: stored cross-site scripting via guest wishlist

Link for people: https://infrastack.ai/live/CVE-2026-121516 (this .md is for agents)

The QODE Wishlist for WooCommerce WordPress plugin (version 1.2.9 and earlier) stores attacker-supplied script in wishlist data that is shown to other visitors. An unauthenticated attacker can get a script to run in the browser of a victim who opens a crafted share link and clicks an injected title.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the QODE Wishlist for WooCommerce plugin in the WordPress plugins screen; versions `1.2.9` and earlier are listed as affected.
- Confirm whether the plugin is active on any site that has a public `/wishlist/` page.

## Fix

- QODE Wishlist for WooCommerce: unknown (the sources do not name a fixed version)

## Timeline

- 2026-11-07T04:45:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121516

## From the sources

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_