Premmerce Wishlist For Woocommerce
Monthly
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) allows an unauthenticated remote attacker to inject script that executes in a victim's browser, with a CVSS 3.1 base score of 7.1 and a scope change (S:C) reflecting that the injected code can affect resources beyond the vulnerable plugin itself. Because the vector is PR:N, no credentials are needed to craft the payload, but the CVSS vector's UI:R means exploitation only succeeds when a victim with an active browser session is lured into opening a crafted link or supplying malicious input; the site must have the vulnerable plugin installed and the targeted page or parameter reachable. No public exploit identified at time of analysis, the plugin has not been reported in CISA KEV, and no EPSS data was supplied, so the practical risk leans moderate rather than urgent.
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries, per the CVSS PR:N vector. Reported by Patchstack and rated 9.3 (CVSS 3.1), it allows extraction of sensitive WordPress/WooCommerce data such as user records and credential hashes. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.
Cross-site scripting in the WordPress plugin Premmerce Wishlist for WooCommerce (versions up to and including 1.1.13) allows an unauthenticated remote attacker to inject script that executes in a victim's browser, with a CVSS 3.1 base score of 7.1 and a scope change (S:C) reflecting that the injected code can affect resources beyond the vulnerable plugin itself. Because the vector is PR:N, no credentials are needed to craft the payload, but the CVSS vector's UI:R means exploitation only succeeds when a victim with an active browser session is lured into opening a crafted link or supplying malicious input; the site must have the vulnerable plugin installed and the targeted page or parameter reachable. No public exploit identified at time of analysis, the plugin has not been reported in CISA KEV, and no EPSS data was supplied, so the practical risk leans moderate rather than urgent.
Unauthenticated cross-site scripting in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.13 and earlier) allows remote attackers to inject script that executes in the target site's own origin once a victim is induced to load attacker-influenced content or click a crafted link. Because the CVSS vector is PR:N, no account on the WordPress site is required to deliver the payload, but exploitation is gated by UI:R - the script only runs after a victim interacts with the malicious page or link - and the effect is confined to client-side script execution in the browser, with no server-side code execution, file write, or database compromise demonstrated by the available data. No public exploit code or in-the-wild exploitation is identified in the supplied intelligence, and the EPSS/KEV signals are absent; the Patchstack advisory is the sole reference, so overall confidence in the details of the injectable parameter is limited even though the affected version range is explicit.
SQL injection in the Premmerce Wishlist for WooCommerce WordPress plugin (versions 1.1.11 and earlier) lets remote unauthenticated attackers inject crafted SQL into backend database queries, per the CVSS PR:N vector. Reported by Patchstack and rated 9.3 (CVSS 3.1), it allows extraction of sensitive WordPress/WooCommerce data such as user records and credential hashes. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided.