CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items.
Explanation of Vulnerability in Simple Terms
TI WooCommerce Wishlist versions 2.10.0 and earlier contain an input validation flaw that allows unauthenticated attackers to modify data on the site. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 2.10.0 to remediate the issue.
What an attacker can do
Modify data on the site without authentication or user interaction.
Potential impact on your site
Attackers can alter site content or settings without logging in, potentially affecting product wishlists or customer data.
Conditions required to exploit
Network access to the site; no authentication or user action required.
Key dates
External resources
Related vulnerabilities
