CVE-2026-106604: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in YITH YITH WooCommerce Compare

The vulnerability identified as CVE-2026-106604 affects the YITH WooCommerce Compare plugin (versions >=0 and <3.15.1). It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in partial disclosure of information, modification of data, or disruption of service within the scope of the affected web application. The vulnerability requires low privileges and user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting user input or employing web application firewalls that can detect and block XSS payloads relevant to this plugin.