# CVE-2026-97292: YITH WooCommerce Tab Manager cross-site scripting in author roles

Source: https://junglewise.ai/threats/cve-2026-97292-author-cross-site-scripting-xss-in-yith-woocommerce-tab-manager-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-97292 · Severity: medium · CVSS 6.5 · Published 2026-09-30

YITH WooCommerce Tab Manager is a WordPress plugin that enables custom product tabs in WooCommerce stores. Versions up to 2.15.0 contain a cross-site scripting vulnerability that allows authenticated users with author privileges to inject malicious scripts. An attacker with author access could steal visitor data, hijack customer accounts, or redirect users to malicious sites.

Vendors: [YITH](https://junglewise.ai/threats/vendors/yith).

## Quick answers

**Is CVE-2026-97292 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97292 being exploited in the wild.

**How severe is CVE-2026-97292?** Medium severity, with a CVSS score of 6.5, published 30 September 2026.

**Which products and versions are affected?** YITH WooCommerce Tab Manager <=2.15.0.

**Is there a fix for CVE-2026-97292?** A patch was published on 2026-09-28: patched in version 2.15.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97292 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97292?** Check whether you run YITH WooCommerce Tab Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the YITH WooCommerce Tab Manager plugin affecting versions 2.15.0 and earlier. The vulnerability requires an authenticated attacker with author-level privileges and user interaction (such as a victim clicking a malicious link or visiting a crafted page). An attacker can inject malicious scripts that persist and execute in the context of other users' browsers. The vulnerability has been patched in version 2.15.1.

## Affected products

- YITH WooCommerce Tab Manager <=2.15.0

## Timeline

- 2026-09-28: disclosed
- 2026-09-28: patched: patched in version 2.15.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/yith-woocommerce-tab-manager/vulnerability/wordpress-yith-woocommerce-tab-manager-plugin-2-15-0-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/yith-woocommerce-tab-manager/vulnerability/wordpress-yith-woocommerce-tab-manager-plugin-2-15-0-cross-site-scripting-xss-vulnerability?_s_id=cve)