{"id":"CVE-2026-52710","kind":"vulnerability","aliases":["CVE-2026-52710"],"related":[],"title":"GIFTiT Free Gifts for WooCommerce: stored script injection through version 4.5","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.","summary":"GIFTiT, a WordPress plugin that adds free gifts to WooCommerce stores, fails to neutralize script-related HTML tags, which the sources call Basic XSS and Code Injection. An attacker can inject script that runs in the browser of people who view the affected page.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ithemeland-free-gifts-for-woo","other","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress plugin `ithemeland-free-gifts-for-woo` (GIFTiT) is installed and its version, in the plugins list of the WordPress admin.\n- Compare the installed version against the affected range: from n/a through `4.5`.","fix":null,"status":"open","published_at":"2026-10-30T19:18:25+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:26:36+00:00","updated_at":"2026-10-30T19:26:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T19:26:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GIFTiT Free Gifts for WooCommerce: stored script injection through version 4.5","impact":"medium","summary":"GIFTiT, a WordPress plugin that adds free gifts to WooCommerce stores, fails to neutralize script-related HTML tags, which the sources call Basic XSS and Code Injection. An attacker can inject script that runs in the browser of people who view the affected page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","ithemeland-free-gifts-for-woo"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the store","analyst_note":"Confirm the fixed version and the vulnerable input point from the NVD entry or the vendor's plugin changelog.","how_to_check":"- Check whether the WordPress plugin `ithemeland-free-gifts-for-woo` (GIFTiT) is installed and its version, in the plugins list of the WordPress admin.\n- Compare the installed version against the affected range: from n/a through `4.5`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the GIFTiT Free Gifts for WooCommerce plugin at version 4.5 or earlier are in the affected range, as the sources state. The sources do not say which settings or user roles are needed to reach the injection point, so unknown whether an account is required. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4175,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-52710':14A,17A '4.5':11A,113C 'add':32B 'affect':70B,104C 'allow':100C 'attack':56B 'basic':50B,84C 'browser':64B 'call':49B 'code':53B,101C 'cve':12A,15A 'fail':38B 'free':2A,20B,33B,90C,96C,106C 'gift':3A,21B,34B,91C,97C,107C 'giftit':1A,27B,89C,105C 'html':44B,78C 'improp':72C 'inject':8A,54B,58B 'injection.this':102C 'issu':103C 'ithemeland':19B,95C 'ithemeland-free-gifts-for-woo':18B,94C 'ithemelandco':88C 'n/a':111C 'neutral':40B,73C 'page':71B,83C 'peopl':66B 'plugin':30B 'relat':43B,77C 'run':61B 'script':7A,42B,59B,76C 'script-rel':41B,75C 'sourc':48B 'store':6A,37B 'tag':45B,79C 'version':10A 'view':68B 'vulner':86C 'web':82C 'woo':23B,99C 'woocommerc':5A,25B,36B,93C,109C 'wordpress':26B,29B 'xss':51B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GIFTiT Free Gifts for WooCommerce plugin at version 4.5 or earlier are in the affected range, as the sources state. The sources do not say which settings or user roles are needed to reach the injection point, so unknown whether an account is required. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52710","severity":null,"published_at":"2026-10-30T19:18:25+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}