# TI WooCommerce Wishlist <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WPC Product Bundles Item Quantity

- **ID:** WPSEC-2026-2397
- **Plugin:** TI WooCommerce Wishlist (`ti-woocommerce-wishlist`), https://wordpress.org/plugins/ti-woocommerce-wishlist/
- **Affected versions:** all versions before 2.14.1
- **Fixed in:** 2.14.1 (Update to 2.14.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ti-woocommerce-wishlist
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2397/

## Description

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled item quantity in the 'woosb_ids' configuration saved with a wishlist item in all versions up to, and including, 2.14.0. This is due to insufficient input sanitization and output escaping: the REST API add_product endpoint stores the 'meta' parameter without sanitization, and the WPC Product Bundles integration prints the saved quantity into the wishlist table without validation or escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts into their own wishlist. The scripts run when another user, including an administrator, views the shared wishlist. Exploitation requires the WPC Product Bundles plugin to be active and the site to have a published bundle product.

## References

- https://wpsec.com/vuln/WPSEC-2026-2397/
- https://plugins.svn.wordpress.org/ti-woocommerce-wishlist/tags/2.14.1/
- https://wordpress.org/plugins/ti-woocommerce-wishlist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2397/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.