{"id":"CVE-2026-125746","kind":"vulnerability","aliases":["CVE-2026-125746"],"related":[],"title":"Back In Stock Notifier for WooCommerce: stored XSS lets scripts run in pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.","summary":"Back In Stock Notifier for WooCommerce by ProPluginsLab fails to neutralize script-related HTML tags in a web page, a cross-site scripting flaw. An attacker can inject code that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["back-in-stock-notifier-for-woocommerce","other","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress plugin `back-in-stock-notifier-for-woocommerce` is installed and its version, from the plugins list in wp-admin or the plugin header.","fix":"- Back In Stock Notifier for WooCommerce: unknown (fixed version not stated; affected through 7.5.2)","status":"open","published_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","triaged_at":"2026-11-11T13:29:34+00:00","updated_at":"2026-11-11T13:29:34+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T13:29:34Z","model":"claude-haiku-5-5","output":{"fix":"- Back In Stock Notifier for WooCommerce: unknown (fixed version not stated; affected through 7.5.2)","reach":"internet","title":"Back In Stock Notifier for WooCommerce: stored XSS lets scripts run in pages","impact":"medium","summary":"Back In Stock Notifier for WooCommerce by ProPluginsLab fails to neutralize script-related HTML tags in a web page, a cross-site scripting flaw. An attacker can inject code that runs in the browser of anyone who views the affected page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["woocommerce","wordpress","back-in-stock-notifier-for-woocommerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"injected scripts run in visitors' or admins' browsers","analyst_note":"Find the fixed version and the vulnerable input on the NVD page or the plugin's changelog, and confirm whether login is needed.","how_to_check":"- Check whether the WordPress plugin `back-in-stock-notifier-for-woocommerce` is installed and its version, from the plugins list in wp-admin or the plugin header.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Store operators running the Back In Stock Notifier for WooCommerce plugin on a WordPress site with WooCommerce, versions through 7.5.2. Sites that do not have the plugin installed can skip it. The sources do not say which page inputs are affected or whether authentication is needed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000768,"input_tokens":4594,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125746':16A,19A '-2026':15A,18A '7.5.2':117C 'affect':71B,107C 'allow':103C 'anyon':67B 'attack':57B 'back':1A,21B,30B,90C,97C,108C 'back-in-stock-notifier-for-woocommerc':20B,96C 'basic':85C 'browser':65B 'code':60B,104C 'cross':52B 'cross-sit':51B 'cve':14A,17A 'fail':38B 'flaw':55B 'html':44B,79C 'improp':73C 'inject':59B 'injection.this':105C 'issu':106C 'let':9A 'n/a':115C 'neutral':40B,74C 'notifi':4A,24B,33B,93C,100C,111C 'page':13A,49B,72B,84C 'propluginslab':37B,89C 'relat':43B,78C 'run':11A,62B 'script':10A,42B,54B,77C 'script-rel':41B,76C 'site':53B 'stock':3A,23B,32B,92C,99C,110C 'store':7A 'tag':45B,80C 'view':69B 'vulner':87C 'web':48B,83C 'woocommerc':6A,26B,28B,35B,95C,102C,113C 'wordpress':29B 'xss':8A,86C","nicknames":[],"mitigations":[],"who_affected":"Store operators running the Back In Stock Notifier for WooCommerce plugin on a WordPress site with WooCommerce, versions through 7.5.2. Sites that do not have the plugin installed can skip it. The sources do not say which page inputs are affected or whether authentication is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backinstocknotifierforwoocommerce","medium","other","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-125746':16A,19A '-2026':15A,18A 'back':1A 'cve':14A,17A 'let':9A 'notifi':4A 'page':13A 'run':11A 'script':10A 'stock':3A 'store':7A 'woocommerc':6A 'xss':8A","search_b":"'affect':71B 'anyon':67B 'attack':57B 'back':21B,30B 'back-in-stock-notifier-for-woocommerc':20B 'browser':65B 'code':60B 'cross':52B 'cross-sit':51B 'fail':38B 'flaw':55B 'html':44B 'inject':59B 'neutral':40B 'notifi':24B,33B 'page':49B,72B 'propluginslab':37B 'relat':43B 'run':62B 'script':42B,54B 'script-rel':41B 'site':53B 'stock':23B,32B 'tag':45B 'view':69B 'web':48B 'woocommerc':26B,28B,35B 'wordpress':29B","search_c":"'7.5.2':117C 'affect':107C 'allow':103C 'back':90C,97C,108C 'back-in-stock-notifier-for-woocommerc':96C 'basic':85C 'code':104C 'html':79C 'improp':73C 'injection.this':105C 'issu':106C 'n/a':115C 'neutral':74C 'notifi':93C,100C,111C 'page':84C 'propluginslab':89C 'relat':78C 'script':77C 'script-rel':76C 'stock':92C,99C,110C 'tag':80C 'vulner':87C 'web':83C 'woocommerc':95C,102C,113C 'xss':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125746","severity":null,"published_at":"2026-11-11T13:17:22+00:00","modified_at":"2026-11-11T13:17:22+00:00","first_seen_at":"2026-11-11T13:27:14+00:00","fetched_at":"2026-11-11T13:27:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}