An unauthenticated Cross Site Scripting vulnerability exists in MC Woocommerce Wishlist versions up to 1.9.19. The flaw allows an attacker to inject arbitrary JavaScript that is executed in the browsers of any visitor to affected wishlist pages, due to insufficient output encoding and classified as CWE‑79.

The MC Woocommerce Wishlist plugin developed by the Moreconvert team for WordPress site that has this plugin installed with version 1.9.19 or earlier is susceptible. The plugin is commonly used in WooCommerce e‑commerce sites to manage wishlists, so e‑commerce sites are the primary category of impacted systems.

The CVSS score of 7.1 classifies the flaw as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation. Because authentication is not required, the likely attack vector is via a crafted URL or malicious user input sent to the wishlist interface; when an unauthenticated visitor opens a malicious wishlist link, the injected script executes in the browser, which could enable client‑side attacks.