The vulnerability is a stored XSS flaw in the TI WooCommerce Wishlist plugin that allows malicious scripts to be injected into wishlist content. When an attacker inserts crafted input into wishlist fields and the input is later rendered without proper escaping, any visitor to the page will have the script executed. This can lead to theft of session cookies, credential phishing, defacement, and client‑side attacks. The weakness matches CWE‑79 and has a CVSS score of 6.5, indicating moderate severity.

The vulnerability applies to the TemplateInvaders TI WooCommerce Wishlist plugin versions up to 2.14.0 inclusive. All WordPress sites that have this plugin installed in any environment are potential targets.

The CVSS score of 6.5 reflects moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting exploitation is possible but not yet widely observed. The likely attack vector is stored XSS via wishlist data insertion. Successful exploitation requires the plugin to render user‑supplied data unescaped in the browser.