The WordPress MC Woocommerce Wishlist plugin contains a stored‑execution cross‑site scripting flaw where user‑supplied input is not properly neutralized before being rendered on a web page. Because malicious scripts persist in the database, they will execute whenever a visitor loads a page that includes wishlist data. An attacker can embed JavaScript to steal cookies, hijack sessions, modify content, or redirect users. The vulnerability is a classic input validation weakness identified as CWE‑79.

The affected product is the Saeed MC Woocommerce Wishlist plugin for WordPress, versions through 2.0.3. Any WordPress installation that has this plugin installed and running a version equal to or older than 2.0.3 is vulnerable.

The flaw carries a CVSS score of 6.5, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The stored nature of the XSS implies that an attacker only needs to insert malicious payloads into the wishlist data; the entry point is not explicitly disclosed in the description, but it is inferred that user‑supplied input is accepted through the plugin’s wishlist interface, whether accessed publicly or via an administrative back‑end. Successful exploitation would compromise the confidentiality or integrity of end‑user sessions, potentially leading to data theft or account takeover. Given the lack of a known exploit framework and absence from KEV, the likelihood of widespread exploitation remains limited, but the impact on users who visit affected pages is non‑negligible.