CVE-2026-112199: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in YITH YITH WooCommerce Wishlist

The vulnerability identified as CVE-2026-112199 in the YITH WooCommerce Wishlist plugin involves improper neutralization of input during web page generation, leading to a stored cross-site scripting (XSS) flaw. This allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability. The affected versions include all releases from initial versions up to but not including 4.19.0.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system. Attackers may execute arbitrary scripts in the context of users viewing the wishlist, potentially leading to session hijacking, defacement, or other malicious actions. The CVSS score of 6.5 reflects a medium severity impact with network attack vector, low attack complexity, and required privileges and user interaction.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting privileges and exercising caution with user-generated content in the affected plugin versions.