The WishSuite – Wishlist for WooCommerce plugin is vulnerable because the button_text attribute of the wishsuite_button shortcode is stored without proper sanitization or escaping. An attacker who can log in with Contributor or higher privileges can insert arbitrary JavaScript into that attribute. When a page containing the shortcode is rendered, the injected script runs in the browser of any visitor, potentially allowing theft of session cookies, defacement, or malicious redirects. This compromise affects the confidentiality and integrity of site content for users who view the affected page.

All installations of the WishSuite – Wishlist for WooCommerce plugin for WordPress, specifically versions up to and including 1.5.1.

The CVSS score of 6.4 characterizes this flaw as a medium‑severity vulnerability. The EPSS score of less than 1% indicates a low probability of current exploitation, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with Contributor-level access or higher who can edit content that includes the wishsuite_button shortcode. Once an injection is stored, any visitor who loads a page containing the shortcode will automatically execute the malicious script, so the impact is client‑side but can be used for serious user‑targeted attacks.