Stored Cross-Site Scripting in Waitlist Woocommerce Plugin for WordPress

CVE-2026-77188

What is CVE-2026-77188?

The Waitlist Woocommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'type' shortcode attribute. This issue arises from inadequate input sanitization and output escaping, allowing authenticated users with contributor-level permissions and above to inject arbitrary scripts into website pages. When these pages are accessed, the injected scripts will execute, potentially compromising site security. The use of the wp_kses_post filter does not mitigate this issue effectively because the shortcode attribute values can pass through without proper filtering, leading to the exploit being realized during render time when the shortcode is processed.

References