# CVE-2026-106604: YITH WooCommerce Compare stored XSS in product listings

Source: https://junglewise.ai/threats/cve-2026-106604-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106604 · Severity: medium · CVSS 6.5 · Published 2026-10-15

YITH WooCommerce Compare is a WordPress plugin that lets online stores display product comparison tables. A stored cross-site scripting (XSS) vulnerability in versions up to 3.15.0 allows attackers with contributor or higher privileges to inject malicious scripts that persist in the database. These scripts execute when customers view product comparisons, potentially stealing their session data or hijacking their accounts.

Vendors: [YITH](https://junglewise.ai/threats/vendors/yith).

## Quick answers

**Is CVE-2026-106604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106604 being exploited in the wild.

**How severe is CVE-2026-106604?** Medium severity, with a CVSS score of 6.5, published 15 October 2026.

**Which products and versions are affected?** YITH WooCommerce Compare up to 3.15.0.

**Is there a fix for CVE-2026-106604?** Yes: fixed in 3.15.1. Until then: Update to version 3.15.1 or later. If immediate update is not possible, restrict contributor and higher-level plugin access to trusted administrators only, or disable the plugin until patched.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-19","note":"Reported by Intrudify"},{"kind":"advisory","at":"2026-10-15","note":"Published by Patchstack"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106604 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-106604?** Check whether you run YITH WooCommerce Compare at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.15.1

Update to version 3.15.1 or later. If immediate update is not possible, restrict contributor and higher-level plugin access to trusted administrators only, or disable the plugin until patched.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-19","note":"Reported by Intrudify"},{"kind":"advisory","at":"2026-10-15","note":"Published by Patchstack"}]

## Technical details

This is a stored XSS vulnerability in YITH WooCommerce Compare through version 3.15.0, arising from improper input neutralization during web page generation. The vulnerability requires user interaction and a contributor-level or higher WordPress account to exploit; the injected payload persists in the database and executes in the browsers of site visitors, allowing session theft or account takeover. A patch is available in version 3.15.1.

## Affected products

- YITH WooCommerce Compare up to 3.15.0

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/yith-woocommerce-compare/vulnerability/wordpress-yith-woocommerce-compare-plugin-3-15-0-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/yith-woocommerce-compare/vulnerability/wordpress-yith-woocommerce-compare-plugin-3-15-0-cross-site-scripting-xss-vulnerability?_s_id=cve)