YITH WooCommerce Compare CVE-2026-106604

Exploitation requires an authenticated account with at least low privileges (PR:L) on the WordPress/WooCommerce site running YITH WooCommerce Compare version 3.15.0 or earlier, plus the ability to submit input into a field the plugin stores and later renders. Execution additionally requires victim interaction (UI:R) - another user (such as an administrator or shopper) must view the page where the payload is rendered. Limiting factors: the need for a pre-existing authenticated foothold, the dependency on a victim loading the poisoned page, and the requirement that the vulnerable plugin be installed and active. It is NOT remotely exploitable by a fully unauthenticated attacker against a default install.

This is a stored (persistent) Cross-Site Scripting flaw (CWE-79) in the YITH WooCommerce Compare plugin, assigned CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - network-reachable, low attack complexity, but requiring low-level authentication (PR:L) and victim user interaction (UI:R). The scope change (S:C) reflects that injected script executes in a different security context (the victim's browser/session) than the vulnerable component. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced (only the Patchstack advisory). The combined signals point to a real but moderate-priority issue rather than an emergency: exploitation requires an authenticated foothold plus a victim viewing the poisoned page, which argues against mass automated exploitation. There is no conflict between the CVSS vector and the description - both are consistent with an authenticated stored XSS. Missing data to note: no EPSS probability and no SSVC decision values were supplied, so automatability and exploitation-maturity cannot be scored from the input; absence of a POC reference does not guarantee none exists elsewhere.

A low-privileged authenticated user (e.g., a shop manager, contributor, or a role permitted to submit data the plugin renders) injects a malicious script payload into a field that the Compare plugin stores and later renders unsanitized. When an administrator or another store user subsequently views the affected page, the stored script executes in their browser session, enabling session/cookie theft or actions in their context. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim loading the compromised page (UI:R).