GIFTiT WooCommerce EUVD-2026-114271

The available sources do not name a specific feature, setting, or deployment mode required - the description states only that improper neutralization of script-related HTML tags allows code injection in GIFTiT versions up to and including 4.5, and the trigger (which input field, stored vs. reflected) is not described. Authentication requirements are not confirmed from the available data: although the supplied CVSS vector lists PR:N and UI:N (suggesting unauthenticated with no interaction), that profile is atypical for an XSS/content-injection flaw, so the real privilege and interaction prerequisites should be verified with Patchstack/vendor before relying on them. Limiting factors: the affected product is a specific, low-footprint WooCommerce plugin, and the impact is confined to low confidentiality (no integrity or availability effect per the vector).

This is a moderate-severity web issue, not a priority emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) indicates a remotely reachable, low-complexity flaw with only low confidentiality impact and no integrity or availability impact. Note a tension in the signals: the flaw is classified as Basic XSS / content injection (CWE-80), yet the vector lists S:U (no scope change), UI:N (no user interaction) and C:L/I:N - an unusual profile for script-injection issues, which typically involve user interaction and a scope change into the victim's browser; the vendor's own title calls it a 'content injection' rather than classic stored/reflected XSS, so the exact mechanism and privilege requirement are not pinned down in the available sources. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified - the only reference is the Patchstack database entry (not working exploit code). The vuln.today decision label is 'this_month', consistent with a patch-this-cycle priority rather than act_now/emergency. Overall: a real but routine WordPress-plugin XSS to schedule for the normal patch cycle, with the caveat that the affected plugin has a small deployment footprint.

An attacker injects script-related HTML into a field handled by the GIFTiT plugin; when the payload is later rendered in a browser session, the injected script executes in that context, enabling limited information disclosure such as session or page data. No public exploit code was identified, and the precise injection point and whether authentication is required are not described in the available sources.