Cross-site Scripting Vulnerability in Waitlist Woocommerce by Xootix
CVE-2026-114701

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Waitlist WooCommerce ( Back In Stock Notifier )
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114701?

A Cross-site Scripting (XSS) vulnerability has been identified in the Waitlist Woocommerce plugin by Xootix, specifically affecting versions from n/a to 2.9.1. This flaw allows an attacker to inject malicious scripts into web pages, potentially compromising user data and session integrity. By exploiting this vulnerability, attackers can store XSS payloads that execute when users visit affected pages, leading to unauthorized actions on behalf of unsuspecting users. This highlights the importance of implementing input sanitization and validation measures to mitigate such risks.

Affected Version(s)

Waitlist Woocommerce ( Back in stock notifier ) 0 <= 2.9.1

References

https://patchstack.com/database/wordpress/plugin/waitlist...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack)
.