TI WooCommerce Wishlist <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WPC Product Bundles Item Quantity
- ID
- WPSEC-2026-2397
- Plugin
- TI WooCommerce Wishlist (ti-woocommerce-wishlist)
- Affected
- all versions before 2.14.1
- Remediation
- Update to 2.14.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- TI WooCommerce Wishlist on WPSec AttackSurface
- Fix released
- Published
Description
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled item quantity in the 'woosb_ids' configuration saved with a wishlist item in all versions up to, and including, 2.14.0. This is due to insufficient input sanitization and output escaping: the REST API add_product endpoint stores the 'meta' parameter without sanitization, and the WPC Product Bundles integration prints the saved quantity into the wishlist table without validation or escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts into their own wishlist. The scripts run when another user, including an administrator, views the shared wishlist. Exploitation requires the WPC Product Bundles plugin to be active and the site to have a published bundle product.
References
- https://wpsec.com/vuln/WPSEC-2026-2397/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.14.1/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS