Waitlist WooCommerce EUVD-2026-111749

Requires an authenticated WordPress account with contributor-level privileges or above (PR:L) on a site running Waitlist Woocommerce (Back in stock notifier) ≤2.9.1. The attacker must place the plugin's shortcode with a crafted 'type' attribute into a post or page; the standard wp_kses_post sanitization on contributor save does not block it because shortcode attribute values are not HTML and pass through kses unchanged, with the payload materializing only when the shortcode is expanded at render. Limiting factors: exploitation is impossible without a contributor+ account (so sites that do not grant untrusted users contributor access are largely unexposed), and the injected script only fires when another user actually views the injected page.

This is a genuine but moderate-priority issue, consistent with its 6.4 (Medium) CVSS and the vuln.today 'this_month' decision label rather than an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N shows network reach and low complexity, but PR:L means the attacker must already hold a contributor-level (or higher) authenticated account, which is the key gating factor and keeps this well below the severity of an unauthenticated flaw. The scope change (S:C) and C:L/I:L reflect a stored XSS whose payload executes in the browsers of other users (including higher-privileged ones) who view the injected page - the real impact driver. No EPSS score and no KEV status were supplied, so there is no quantitative exploitation-probability or active-exploitation signal; absence of KEV should be read as 'not listed/known,' not as 'safe.' No public exploit or PoC reference was provided either. The signals are internally consistent (authenticated stored XSS, medium severity, routine-patch urgency) with no contradictions, but the lack of EPSS/KEV data means the external-exploitation picture is simply unknown. Net: a real vulnerability worth patching on a normal monthly cycle, elevated only where untrusted contributor accounts exist.

An attacker who holds or obtains a WordPress contributor account on a site running this plugin creates or edits a post containing the plugin's shortcode with a malicious 'type' attribute carrying a script payload. Because the payload lives in a shortcode attribute (not HTML), the wp_kses_post filter applied on contributor save leaves it intact, and it is rendered into executable script when the shortcode expands at page-view time. When an editor, administrator, or visitor opens the page, the script runs in their session, enabling session/credential theft or actions in their context. No public exploit code was identified in the supplied data.