The TI WooCommerce Wishlist plugin contains a stored cross‑site scripting flaw that arises from improper neutralization of user input during page generation. Malicious JavaScript can be persisted in the wishlist’s data and will execute in the browsers of users who view the affected wishlist entry. The CVE description provides only this broad statement of stored XSS with no additional operational details.

All installations of the TI WooCommerce Wishlist plugin from its first release through version 2.10.0 are vulnerable. The issue applies to any WordPress site that has the plugin enabled, regardless of the specific WooCommerce or WordPress versions.

The CVSS score of 6.5 indicates a moderate level of risk. The EPSS score of less than 1 % suggests that exploitation is unlikely, although not impossible; attackers might target high‑traffic stores that use the plugin. The vulnerability is not listed in CISA KEV, and no public exploit is documented. The likely attack vector involves an attacker who can supply content to the wishlist; the injected data is stored and later rendered when other users view the wishlist, causing script execution in their browsers.