Waitlist WooCommerce CVE-2026-114701

Exploitation requires an authenticated account with at least low-level privileges on the WordPress site (PR:L) capable of submitting input the plugin stores, plus a victim (typically an administrator or staff user) subsequently viewing the page where the stored payload is rendered (UI:R). The available sources do not name the exact vulnerable input field, parameter, or configuration path, so the precise injection point and whether any non-default plugin setting is required are not described in the evidence. Limiting factors that reduce realistic risk below the raw score: the mandatory authenticated foothold, the dependency on victim interaction to trigger execution, and the requirement that the Waitlist Woocommerce plugin (version ≤ 2.9.1) be installed and active alongside WooCommerce.

This is a stored Cross-Site Scripting flaw (CWE-79) in the xootix 'Waitlist Woocommerce (Back in stock notifier)' WordPress plugin, affecting all versions up to and including 2.9.1. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) indicates a network-reachable, low-complexity issue that nonetheless requires an authenticated low-privileged account (PR:L) AND victim interaction (UI:R) to land - both of which meaningfully constrain real-world exploitation. The scope change (S:C) and the three Low impacts reflect script execution crossing from the injected store context into a victim's browser session, a signature typical of Patchstack-reported stored XSS. On the exploitation signals: there is no CISA KEV listing, no EPSS probability supplied in the input, and no confirmed proof-of-concept - the single reference is a Patchstack database advisory, not working exploit code. The vuln.today priority is 'this_month,' not act_now or emergency, which is consistent with a moderate-severity, authentication-and-interaction-gated issue rather than an actively exploited emergency. Net assessment: a legitimate but non-urgent patching item - real priority is moderate, driven by the privilege and interaction prerequisites, not a high-CVSS-masking-low-risk situation nor a widespread-exploitation emergency. Note that EPSS is absent from the input, so widespread-exploitation probability cannot be quantified here.

An attacker holding a low-privileged authenticated account injects a malicious script payload into a plugin-handled input field (e.g. a waitlist/back-in-stock submission or setting); the payload is stored and later rendered when an administrator or other user views the affected page, executing the script in that victim's browser session. Exploitation requires that stored authenticated access plus the victim viewing the tainted content, and no verified working exploit code is published - the only reference is a Patchstack advisory.