Stored XSS Vulnerability in WebToffee Wishlist for WooCommerce
CVE-2025-24657

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Wishlist For WooCommerce
Vendor
CVE Published:
24 January 2025

What is CVE-2025-24657?

A serious vulnerability in WebToffee Wishlist for WooCommerce allows for Stored Cross-site Scripting (XSS). This flaw occurs due to improper neutralization of user input during web page generation, enabling attackers to inject malicious scripts. Users of versions from n/a to 2.1.2 are particularly at risk, as the vulnerability could be exploited to manipulate the website and compromise user data. It is essential for site administrators to apply appropriate security measures to protect against potential exploitation.

Affected Version(s)

Wishlist for WooCommerce <= 2.1.2

References

https://patchstack.com/database/wordpress/plugin/wt-wooco...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

b4orvn (Patchstack Alliance)
.