CVE-2026-57356: MC Woocommerce Wishlist Unauthenticated XSS Vulnerability (v1.9.19 and Earlier)

Technical summary

CVE-2026-57356 is an unauthenticated reflected or stored XSS flaw in MC Woocommerce Wishlist affecting versions up to 1.9.19. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). With a CVSS 3.1 score of 7.1 (HIGH), the attack vector is network-based, requires no privileges, and involves minimal complexity. The impact spans confidentiality, integrity, and availability due to the cross-site nature (scope change) of the vulnerability. User interaction is required—an admin or customer must visit a malicious link or page—but the network accessibility and lack of authentication significantly lower the barrier to exploitation.

Business impact

An XSS vulnerability in a wishlist plugin poses direct risk to customer trust and data security. Attackers could harvest session cookies or authentication tokens from site visitors, leading to account takeover. Customer personal information, purchase history, or payment details could be exposed or manipulated. Additionally, the plugin's use across multiple Woocommerce sites means a single exploit could affect many merchants simultaneously if the vulnerability becomes widely known or weaponized. Regulatory exposure (PCI DSS, GDPR) may apply if customer data is compromised.

Affected systems

MC Woocommerce Wishlist plugin versions 1.9.19 and earlier are vulnerable. Any Woocommerce store using an affected version of this plugin is at risk. The vulnerability can be exploited against site visitors (customers, admins) regardless of their privilege level, making the exposure broad across any traffic to wishlist pages or features.

Exploitability

Exploitation is straightforward and requires no authentication. An attacker crafts a malicious URL or injects a payload into a wishlist page and tricks or socially engineers a site visitor into clicking the link or viewing the page. The low complexity and network accessibility make this vulnerability attractive to attackers. No known exploit is currently listed in the CISA KEV catalog, but the attack surface is large and the technique is well-understood in the security community.

Remediation

Update MC Woocommerce Wishlist to a patched version newer than 1.9.19 as soon as possible. Verify the exact patch version in the official plugin repository or vendor advisory. Additionally, implement Web Application Firewall (WAF) rules to detect and block XSS payloads targeting wishlist endpoints as a temporary mitigation. Consider disabling the wishlist feature entirely until patching is confirmed if the plugin is not actively maintained or updates are delayed.

Patch guidance

Contact the MC Woocommerce Wishlist vendor or check the WordPress plugin repository for available updates beyond version 1.9.19. Apply the update in a staging environment first to verify compatibility with your Woocommerce installation and any custom code. After patching, test wishlist functionality and re-enable the plugin. If the vendor has not released a patch, consider switching to an alternative, actively maintained wishlist plugin.

Detection guidance

Monitor web server and WAF logs for unusual patterns in wishlist page requests, particularly those containing script tags, event handlers (onclick, onerror), or URL-encoded payloads. Use your SIEM to correlate suspicious requests from external IPs with subsequent admin or customer activity. Check plugin version using your site's admin dashboard or a WordPress security scanner. Inspect published wishlist URLs and page source code for unexpected JavaScript, particularly in user-controlled fields (product names, descriptions, custom attributes).

Why prioritize this

Although not yet in the CISA KEV catalog, this HIGH-severity vulnerability warrants rapid patching because it is unauthenticated, affects a plugin used across many Woocommerce stores, and enables account compromise or data theft. The low complexity and network accessibility mean an attacker can exploit it at scale once the vulnerability is publicly disclosed or added to exploit databases. Prioritize this above patch management for lower-severity issues but coordinate with your vendor to confirm patch availability.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a HIGH severity rating. The score is driven by network-based attack vector, no authentication required, and cross-site scope (affecting both confidentiality and integrity). Although user interaction is required to trigger the exploit, the combination of low barriers to entry, broad exposure (any site visitor can be targeted), and real-world impact on customer data and site integrity justifies the elevated score. The lack of a known exploit in active use and absence from the KEV catalog do not reduce the inherent risk.

Frequently asked questions