The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject arbitrary HTML and JavaScript into pages rendered by the YITH WooCommerce Wishlist plugin. Because the plugin does not correctly sanitize or encode user‑supplied data before including it in the web page, content can be injected into the wishlist interface and subsequently displayed to other site visitors, enabling execution of script in their browsers. This can lead to theft of session cookies, defacement or malicious redirects, and other client‑side impacts. The weakness is listed as CWE‑79.

Affected systems are installations of the WordPress YITH WooCommerce Wishlist plugin version 4.18.1 or earlier. The plugin is maintained by YITH. Versions from the earliest release up through 4.18.1 are impacted. Administrators should verify the plugin version and apply the update to 4.19.0 or later.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the lack of a KEV listing suggests no confirmed exploits yet. Attackers can exploit the flaw by creating or modifying wishlist content with malicious payloads; any user who visits a page containing the compromised wishlist will receive the injected code. The most likely attack vector is through the administrative or customer interface that allows wishlist item creation, which is accessible after authentication. Proper sanitization mitigates the risk.