TI WooCommerce Wishlist CVE-2025-9207

Exploitation requires that the TI WooCommerce Wishlist plugin (any version through 2.10.0) be installed and active on a WordPress/WooCommerce site with wishlist functionality reachable by unauthenticated visitors - the default state for a storefront. The specific vector is the plugin accepting arbitrary hidden-field values on wishlist item submission and later outputting them without validation, so no special non-default configuration is needed. Limiting factors: impact is confined to HTML markup injection (not confirmed script execution per the vendor), the injected content only takes effect when a user subsequently views the affected wishlist item, and sites already updated past 2.10.0 are not affected.

This is a genuinely low-to-moderate priority issue despite the unauthenticated network vector. The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects a single limited impact: integrity-only (I:L) with no confidentiality or availability consequence, because the flaw permits HTML injection into wishlist items rather than script execution or data access. The EPSS score of 0.42% (34th percentile) is low, indicating no significant observed or predicted exploitation activity. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. The one signal elevating attention is the unauthenticated nature (PR:N) combined with the plugin's sizable WordPress install base. Note a nuance: the CVSS caps impact at I:L and marks scope unchanged (S:U), but HTML injection into content later rendered to other users can, depending on output context and sanitization elsewhere, approach stored-XSS-like effects - the vendor scored this conservatively as HTML injection only, so treat the real impact as content/markup manipulation rather than confirmed script execution unless further analysis proves otherwise. Overall: a real but low-severity hygiene fix, not an emergency.

An unauthenticated attacker submits a crafted request to the wishlist functionality, supplying hidden-field values containing arbitrary HTML that the plugin stores and later renders in wishlist items without adequate validation. When a victim (shopper or administrator) views the affected wishlist, the injected HTML is rendered in their browser, enabling defacement, misleading content, or phishing lures embedded in the trusted store page. No public exploit code is referenced, and exploitation requires no authentication or user interaction to inject the payload.