Premmerce Wishlist EUVD-2026-90837

Requires an attacker to deliver a crafted input/link to the vulnerable Premmerce Wishlist for WooCommerce plugin (version <= 1.1.13) and to lure a victim with an active browser into triggering it (UI:R) - exploitation does not succeed purely server-side or without victim interaction. No authentication is required (PR:N), so any internet user can craft the payload, but the attack is limited by: the WordPress site must have this specific WooCommerce wishlist plugin installed and at a vulnerable version, the targeted page/parameter must be reachable, and a human victim must interact with the malicious link or input for the script to execute in their session.

Signals are mixed and lean toward a moderate, not urgent, priority. The CVSS 3.1 base score of 7.1 is inflated by the scope-change (S:C) and the combined low C/I/A impacts typical of Patchstack's reflected-XSS scoring; the real-world impact is browser-side script execution in a single victim's session, not server compromise. The vector is network-reachable and low-complexity with no privileges required (AV:N/AC:L/PR:N), which raises reach, but it is gated by required user interaction (UI:R) - a victim must be lured into triggering the crafted request/link, so mass automated exploitation is unlikely. No EPSS score, no CISA KEV listing, and no public proof-of-concept were supplied, so there is no evidence of active exploitation; this is 'no public exploit identified at time of analysis.' Net: a legitimate issue to patch on a normal cadence, not a drop-everything emergency. Note a minor inconsistency to verify with the vendor: the description labels this 'Unauthenticated XSS' consistent with PR:N, but Patchstack listings sometimes conflate reflected vs. stored - confirm the injection/trigger path before assuming no authentication or interaction is needed.

An attacker crafts a malicious URL or form input targeting the vulnerable Premmerce Wishlist for WooCommerce plugin parameter and distributes it (phishing email, malicious link, or embedded on a third-party page). When a WooCommerce shopper or store user clicks it, the unsanitized input is reflected into the page and arbitrary JavaScript executes in their browser session, enabling session/cookie theft or actions in the victim's context. No public proof-of-concept was identified at the time of analysis, and successful exploitation depends on convincing a victim to interact (UI:R).