What is the CVSS score of CVE-2026-57356?

CVE-2026-57356 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of MC WooCommerce Wishlist are affected by CVE-2026-57356?

The MC WooCommerce Wishlist plugin (versions ≤1.9.19) contains a reflected/stored XSS vulnerability allowing remote unauthenticated attackers to inject malicious scripts into customer browsers,…

How to fix or mitigate CVE-2026-57356?

Within 24 hours: Audit all WordPress installations for MC WooCommerce Wishlist plugin presence; immediately disable or deactivate all instances running version 1.9.19 or earlier. Within 7 days: Evaluate and select alternative wishlist solutions; if the plugin is business-critical, deploy Web Application Firewall (WAF) rules to block XSS payloads targeting the affected plugin endpoints. Within 30 days: Migrate all WordPress instances to a patched or alternative solution, or apply a security patch if the vendor releases version 1.9.20 or later.

MC WooCommerce Wishlist CVE-2026-57356

EUVD-2026-41355 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-xfpp-93xp-3xr4

WordPress XSS Wordpress Plugin Mc Woocommerce Wishlist

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unauthenticated injection needing victim interaction (UI:R); browser-context execution in site origin justifies scope change (S:C) with limited C/I/A impact typical of XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:15 vuln.today

CVE Published

Jul 02, 2026 - 11:15 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

AnalysisAI

Reflected/stored cross-site scripting in the MC WooCommerce Wishlist WordPress plugin (also distributed as 'Smart Wishlist for MoreConvert') affects all versions up to and including 1.9.19, letting remote unauthenticated attackers inject malicious script that executes in a victim's browser after the victim interacts with a crafted link or request. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress site's origin, enabling session/cookie theft or actions against other users. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress e-commerce plugin (CPE cpe:2.3:a:moreconvert_team:mc_woocommerce_wishlist) that extends WooCommerce with wishlist functionality. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored and rendered into HTML output without adequate output encoding or input sanitization. In the WordPress/PHP context this typically arises from echoing request parameters (GET/POST) or persisted wishlist data into page markup without esc_html/esc_attr/wp_kses treatment, allowing HTML/JavaScript to break out of the intended data context.

RemediationAI

Upgrade the plugin to a version later than 1.9.19; however, no vendor-released patched version is identified in the provided data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/smart-wishlist-for-more-convert/vulnerability/wordpress-mc-woocommerce-wishlist-plugin-1-9-19-cross-site-scripting-xss-vulnerability) and the WordPress.org plugin page for the fixed release before deploying. Until a confirmed fix is available, compensating controls include deploying a WAF or virtual patch (Patchstack itself offers this) to filter XSS payloads on the plugin's request parameters, applying a restrictive Content-Security-Policy that disallows inline script to blunt payload execution (trade-off: may break legitimate inline scripts and require testing), and restricting or disabling the wishlist feature/endpoints on high-value stores if usage permits (trade-off: loss of wishlist functionality for customers). Standard defenses like HttpOnly cookies reduce, but do not eliminate, XSS impact.