Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock… (CVE-2026-114701)

The xootix Waitlist Woocommerce (Back in stock notifier) plugin suffers from a stored cross-site scripting (XSS) vulnerability (CWE-79) due to improper neutralization of input during web page generation. This flaw affects all versions up to and including 2.9.1. Exploitation requires at least limited privileges and user interaction, and it can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No known exploits are reported in the wild, and no patch or remediation information is provided in the source data.

Successful exploitation of this stored XSS vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of the affected web application. This may lead to partial compromise of confidentiality, integrity, and availability of the application or user data. The vulnerability requires user interaction and privileges, limiting the scope of impact. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that can be stored and rendered, and apply web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and patches addressing this vulnerability.