Stored Cross-Site Scripting Vulnerability in Flexible Wishlist Plugin for WooCommerce by WordPress
CVE-2024-13696
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 January 2025
What is CVE-2024-13696?
The Flexible Wishlist for WooCommerce plugin for WordPress contains a vulnerability that allows Stored Cross-Site Scripting via the 'wishlist_name' parameter. This issue arises from inadequate input sanitization and output escaping across all versions up to and including 1.2.25. As a result, unauthenticated attackers can inject malicious web scripts into pages, which will execute whenever a user accesses the affected page. This vulnerability can lead to various security issues, including unauthorized actions on behalf of users or data breaches.
Affected Version(s)
Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later * <= 1.2.25