Cross-site Scripting Flaw in TI WooCommerce Wishlist by TemplateInvaders

CVE-2025-32920

What is CVE-2025-32920?

A critical vulnerability has been identified in the TI WooCommerce Wishlist plugin by TemplateInvaders, which allows for improper neutralization of input during web page generation, leading to stored Cross-site Scripting (XSS) attacks. This issue could enable attackers to inject malicious scripts that execute in the context of a user's session, potentially compromising sensitive data and the integrity of the website. It affects versions from n/a through 2.9.2, highlighting a significant security concern for users of this WordPress plugin.

References