YITH WooCommerce Wishlist EUVD-2026-104250

Exploitation requires an authenticated account with at least low-level privileges (PR:L) on the target WordPress site running YITH WooCommerce Wishlist version 4.18.1 or earlier, plus WooCommerce installed. The attacker must store a crafted XSS payload through a plugin-controlled wishlist input, and the payload only triggers when another user interacts with/views the affected page (UI:R) - meaning the impact depends on a higher-privileged victim (e.g., an administrator) rendering the poisoned content. Limiting factors: no unauthenticated path (an account is required), mandatory victim interaction, and only partial confidentiality/integrity/availability impact; the plugin must be present and the vulnerable field reachable by the attacker's role.

This is a moderate-severity Stored XSS (CWE-79) in the YITH WooCommerce Wishlist plugin, scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates a network-reachable but authenticated (PR:L) flaw that also requires victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis. The signals are internally consistent - nothing in the description contradicts the CVSS vector - but the combination of required low-level authentication plus mandatory user interaction and only partial (L/L/L) impact places this well below the urgency of unauthenticated or actively-exploited flaws. The practical risk is driven more by the plugin's large install base than by ease of exploitation: a low-privileged contributor/customer could persist malicious script that fires when a higher-privileged user (e.g., a shop admin) views the affected data. Treat as a standard-priority patch item rather than an emergency, absent any exploitation evidence. Missing data: no EPSS, no KEV, no POC confirmation, and no vendor advisory beyond the Patchstack database entry.

A low-privileged authenticated user (e.g., a registered customer or contributor) submits input through a wishlist-related field that the plugin fails to sanitize, persisting a malicious script payload. When a store administrator or another user later views the affected page, the stored script executes in their authenticated browser session, enabling session/cookie theft or actions performed as the victim. No public proof-of-concept exploit is identified in the provided data, and successful exploitation depends on the victim viewing the poisoned content (UI:R).