Live › vulnerability › CVE-2026-52710
GIFTiT, a WordPress plugin that adds free gifts to WooCommerce stores, fails to neutralize script-related HTML tags, which the sources call Basic XSS and Code Injection. An attacker can inject script that runs in the browser of people who view the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the GIFTiT Free Gifts for WooCommerce plugin at version 4.5 or earlier are in the affected range, as the sources state. The sources do not say which settings or user roles are needed to reach the injection point, so unknown whether an account is required. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
ithemeland-free-gifts-for-woo (GIFTiT) is installed and its version, in the plugins list of the WordPress admin.4.5.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-52710")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.