The vulnerability is a stored cross‑site scripting flaw in the WebToffee Wishlist for WooCommerce plugin. The description states that malicious JavaScript can be placed into wishlist data that is rendered unescaped. Based on this, it is inferred that the payload could be executed whenever a user views a page that displays wishlist items, potentially compromising confidentiality, integrity or availability. The weakness is classified as CWE‑79.

Affected systems are WordPress installations that have the WebToffee Wishlist for WooCommerce plugin version ≤ 2.1.2. The plugin allows users to add or edit wishlist items; based on this, sites where customers or administrators can modify wishlist entries could be used to inject malicious input.

Against the available data the CVSS score is 5.9, indicating a moderate severity, and the EPSS score is < 1 %, showing a limited probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a web user visiting a wishlist page that contains the injected payload; the vulnerability would typically be exploitable by anyone with the ability to create or edit wishlist entries.