# CVE-2026-112199: YITH WooCommerce Wishlist stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-112199-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112199 · Severity: medium · CVSS 6.5 · Published 2026-10-19

YITH WooCommerce Wishlist is a WordPress plugin that allows customers to save products they want to purchase later. A stored cross-site scripting vulnerability in versions up to 4.18.1 allows contributors or higher-privilege users to inject malicious scripts that execute when other users view the wishlist. Attackers could steal visitor data, hijack accounts, or redirect users to malicious sites.

Technologies: [YITH WooCommerce Wishlist](https://junglewise.ai/threats/technologies/woocommerce-wishlist). Vendors: [YITH](https://junglewise.ai/threats/vendors/yith).

## Quick answers

**Is CVE-2026-112199 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112199 being exploited in the wild.

**How severe is CVE-2026-112199?** Medium severity, with a CVSS score of 6.5, published 19 October 2026.

**Which products and versions are affected?** YITH WooCommerce Wishlist up to 4.18.1.

**Is there a fix for CVE-2026-112199?** Yes: fixed in 4.19.0. Until then: Update to version 4.19.0 or later immediately. If unable to update, restrict contributor and above roles to trusted users only.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-20","note":"Reported by Intrudify to Patchstack"},{"kind":"advisory","at":"2026-10-19","note":"Published by Patchstack and NVD"},{"kind":"patched","at":"2026-10-19","note":"Version 4.19.0 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112199 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112199?** Check whether you run YITH WooCommerce Wishlist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.19.0

Update to version 4.19.0 or later immediately. If unable to update, restrict contributor and above roles to trusted users only.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-20","note":"Reported by Intrudify to Patchstack"},{"kind":"advisory","at":"2026-10-19","note":"Published by Patchstack and NVD"},{"kind":"patched","at":"2026-10-19","note":"Version 4.19.0 released"}]

## Technical details

The plugin fails to properly sanitize user input when generating wishlist pages, allowing authenticated users with contributor privilege or above to inject persistent JavaScript that executes in other users' browsers. This stored XSS requires user interaction (a privileged user must click a malicious link or visit a crafted page) but persists in the application. The vulnerability is addressed in version 4.19.0.

## Affected products

- YITH WooCommerce Wishlist up to 4.18.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/yith-woocommerce-wishlist/vulnerability/wordpress-yith-woocommerce-wishlist-plugin-4-18-1-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/yith-woocommerce-wishlist/vulnerability/wordpress-yith-woocommerce-wishlist-plugin-4-18-1-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [YITH WooCommerce Wishlist unauthenticated arbitrary wishlist rename](https://junglewise.ai/threats/cve-2026-82305-yith-woocommerce-wishlist-unauthenticated-arbitrary-wishlist)