Cross-Site Scripting Vulnerability in ProPluginsLab's WooCommerce Plugin
CVE-2026-125746

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Back In Stock Notifier For WooCommerce
Vendor
CVE Published:
11 November 2026

What is CVE-2026-125746?

The Back In Stock Notifier for WooCommerce by ProPluginsLab is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of HTML tags in user input. This weakness allows attackers to inject malicious code, which can be executed in the context of users' browsers. This issue is present in versions ranging from n/a to 7.5.2, posing a risk of unauthorized script execution and potential data theft.

Affected Version(s)

Back In Stock Notifier for WooCommerce 0 <= 7.5.2

References

https://patchstack.com/database/wordpress/plugin/back-in-...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Askar | Patchstack Bug Bounty Program
.