Waitlist Woocommerce Back In Stock Notifier
Monthly
Stored cross-site scripting in the Waitlist WooCommerce (Back in stock notifier) plugin for WordPress, affecting all versions up to and including 2.9.1, lets an authenticated user with contributor-level access or above place the plugin's shortcode with a crafted 'type' attribute into a post or page and have arbitrary script execute in the browser of anyone who views that page. The wp_kses_post filter applied on contributor post save does not stop the payload because shortcode attribute values contain no HTML markup and pass through kses unchanged, with the script only materializing when the shortcode is expanded at render time. Rated 6.4 (Medium) with the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N; no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with the vuln.today priority label placing it at 'this_month' rather than emergency.
Stored cross-site scripting in the Waitlist WooCommerce (Back in stock notifier) plugin for WordPress, affecting all versions up to and including 2.9.1, lets an authenticated user with contributor-level access or above place the plugin's shortcode with a crafted 'type' attribute into a post or page and have arbitrary script execute in the browser of anyone who views that page. The wp_kses_post filter applied on contributor post save does not stop the payload because shortcode attribute values contain no HTML markup and pass through kses unchanged, with the script only materializing when the shortcode is expanded at render time. Rated 6.4 (Medium) with the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N; no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with the vuln.today priority label placing it at 'this_month' rather than emergency.