Stored Cross-Site Scripting Vulnerability in QODE Wishlist for WooCommerce Plugin

CVE-2026-121516

What is CVE-2026-121516?

The QODE Wishlist for WooCommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to inject arbitrary web scripts via the 'qode_wishlist_for_woocommerce_guests_items' parameter. This issue arises from inadequate input sanitization and output escaping across all versions up to and including 1.2.9, letting attackers exploit a public nonce visible to guests on the /wishlist/ page. By leveraging control over the transient key and enticing victims to click on a specially crafted link, attackers can execute scripts site-wide. Note that successful exploitation requires an administrator's action, as the attacker cannot initiate the exploit independently.

References