EUVD-2026-90835
GHSA-f77q-5v8m-wpvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload in plugin input
-
DeliveryDeliver crafted link to store visitor
-
ExploitVictim loads page, payload reflects unsanitized
-
ExecutionScript executes in site origin
-
ImpactHijack session or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Premmerce Wishlist for WooCommerce plugin version 1.1.13 or earlier installed on a WordPress/WooCommerce site. No authentication is needed (PR:N), but exploitation requires victim user interaction (UI:R) - typically the target must click an attacker-crafted link or load attacker-influenced page content for the injected script to execute. Impact is limited to client-side script execution in the site origin (no server-side code execution); the UI:R dependency and client-side-only effect are the primary limiting factors. The specific injectable parameter or plugin feature is not named in the available data. |
| Impact | Signals are thin but internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) describes unauthenticated, network-reachable XSS that requires victim interaction and crosses a scope boundary (browser execution context). No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 7.1 rating is driven largely by PR:N combined with S:C and the triple C:L/I:L/A:L impact - a common Patchstack scoring pattern for unauthenticated XSS that tends to run slightly hotter than the real-world impact (client-side script execution bounded by UI:R). Net: this is a legitimate but moderate web-application flaw, not a high-urgency network-exploitable RCE. The UI:R requirement (a victim must click a crafted link or load attacker-influenced content) and the client-side-only impact make it a patch-in-routine-cycle item rather than an emergency, absent any exploitation telemetry. |
| Exploit ScenarioDerived | An attacker crafts a URL or input that reflects an unsanitized, script-bearing payload through the Premmerce Wishlist for WooCommerce plugin on a victim WooCommerce store, then lures a shopper or admin into loading it. When the victim's browser renders the page, the injected JavaScript executes in the site's origin, enabling session/cookie theft, actions on behalf of the victim, or defacement. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim interacting with the malicious content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
RemediationAI
No vendor-released patch is identified in the available data: the advisory bounds the vulnerable range at version 1.1.13 and the supplied references point only to the Patchstack database entry (https://patchstack.com/database/wordpress/plugin/premmerce-woocommerce-wishlist/vulnerability/wordpress-premmerce-wishlist-for-woocommerce-plugin-1-1-13-cross-site-scripting-xss-vulnerability-2?_s_id=cve), with no fix version, GitHub commit, or changelog entry cited, so administrators should monitor that advisory and the plugin's WordPress.org changelog for a release above 1.1.13 and upgrade as soon as one is confirmed to address this CVE. If an updated release is unavailable, the most direct compensating control is to deactivate and remove the Premmerce Wishlist for WooCommerce plugin - the trade-off being complete loss of wishlist functionality for storefront customers, which is acceptable for sites that can do without the feature. Where the feature must remain, restrict exposure by placing the affected store pages behind authentication or a maintenance/preview mode so that unauthenticated visitors cannot reach the injection surface, at the cost of blocking legitimate anonymous shoppers. A reverse-proxy or WAF in front of the site can be configured to block requests containing script payloads or HTML metacharacters targeting the plugin's wishlist endpoints and parameters, but this depends on knowing the exact injectable parameter (not disclosed in the available data), so rules should be tuned empirically and will produce false positives on legitimate wishlist interactions; a restrictive Content-Security-Policy header or trusted-types configuration can also blunt script execution in the site origin, though it may break inline scripts and third-party widgets and is a defense-in-depth measure rather than a fix. Because exploitation requires victim interaction (UI:R) and no public exploit code is known, prioritized patching plus user awareness about unsolicited wishlist links is reasonable in the interim, but none of these controls replaces an upstream upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a third-party WordPress plugin, Premmerce Wishlist for WooCommerce, which adds wishlist functionality to WooCommerce storefronts and therefore renders attacker-reachable page content on public-facing store pages. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting), meaning user-controllable input is reflected into or stored in a generated HTML response without adequate output encoding or sanitization. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L describes a network-reachable, low-complexity attack requiring no prior authentication but requiring victim interaction; the Scope:Changed rating reflects that the injected script executes in the origin of the WordPress site rather than in a separate vulnerable component's security authority, allowing it to act on behalf of the site in the victim's browser. The CPE cpe:2.3:a:premmerce:premmerce_wishlist_for_woocommerce:*:*:*:*:*:*:*:* is a wildcard covering all versions, with the advisory text bounding impact at version 1.1.13 and earlier. The specific vulnerable parameter, endpoint, or plugin feature is not named in the available data, so the exact injection point (for example a wishlist add/remove request parameter, a shortcode attribute, or a rendered wishlist page field) cannot be stated with confidence; both reflected and stored XSS delivery models are consistent with the evidence.
Know when Premmerce Wishlist For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-reachable XSS (PR:N, AV:N, AC:L) requiring victim interaction (UI:R); browser-context execution crosses scope (S:C) with limited client-side C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Executive ViewAI
The Premmerce Wishlist for WooCommerce plugin, versions 1.1.13 and earlier, contains a high-severity unauthenticated cross-site scripting issue that could let an attacker execute malicious scripts in a victim’s browser after user interaction. With no vendor-released patch identified at time of analysis, any WordPress site running the affected plugin remains exposed to customer-trust, session, and website-reputation risks. Leadership should prioritize identifying affected sites and applying interim mitigations even though no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing Premmerce Wishlist for WooCommerce versions 1.1.13 and earlier, applying virtual patching/WAF rules for XSS, enforcing Content Security Policy, restricting or disabling public wishlist endpoints, and monitoring logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unaut
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) al
Exploit-DB