Stored cross-site scripting in Waitlist Woocommerce plugin
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Waitlist Woocommerce (Back in stock notifier) WordPress plugin is affected in all versions up to and including 2.9.1. Insufficient input sanitization and output escaping of the 'type' shortcode attribute (CWE-79) let stored script survive save and run at render time. An attacker with contributor-level access or above can inject scripts that run for any user who opens the affected page.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied on contributor post save does not prevent this vulnerability because shortcode attribute values are not HTML and pass through kses unchanged; the payload is materialized only at render time when the shortcode is expanded.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Waitlist Woocommerce ( Back in stock notifier ).
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-28 Threatist record created from CVE-2026-77188
- 2026-10-28 Alias added: GHSA-9v87-xmhx-x7mr
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-10-29 CISA SSVC decision points changed
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/41348b65-97d7-467f-801f-a168eb366bba?source=cve
- https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.9.0/includes/xoo-wl-functions.php#L114
- https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.9.0/includes/xoo-wl-functions.php#L155
- https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.9.0/includes/xoo-wl-functions.php#L170
- https://plugins.trac.wordpress.org/changeset/3765571/waitlist-woocommerce/trunk/includes/xoo-wl-functions.php
More xootix vulnerabilities
- TI-2024-04943 XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update CVSS 3.1HIGH 8.8
- TI-2022-00152 XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update CVSS 3.1HIGH 8.8
- TI-2023-02534 OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation CVSS 3.1HIGH 8.1
- TI-2022-22342 WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
- TI-2020-18886 Login/Signup Popup < 1.5 - Missing Authorization CVSS 3.1HIGH 7.4
- TI-2026-10507 OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-77188 · CVE Program
- CVE-2026-77188 · NVD
- FIRST EPSS
- GHSA-9v87-xmhx-x7mr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences