Cross-Site Scripting Vulnerability in TI WooCommerce Wishlist by TemplateInvaders
CVE-2026-120855

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Ti WooCommerce Wishlist
Vendor
CVE Published:
9 November 2026

What is CVE-2026-120855?

The TI WooCommerce Wishlist plugin by TemplateInvaders contains a Cross-Site Scripting (XSS) vulnerability that arises from improperly neutralizing user input during web page generation. This vulnerability can lead to stored XSS attacks, potentially allowing an attacker to inject malicious scripts into web pages viewed by other users. The issue affects multiple versions of the plugin, specifically from n/a to 2.14.0, posing a security risk for websites utilizing this plugin.

Affected Version(s)

TI WooCommerce Wishlist 0 <= 2.14.0

References

https://patchstack.com/database/wordpress/plugin/ti-wooco...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Filip Kowalski | Patchstack Bug Bounty Program
.