The vulnerability is an unauthenticated Cross Site Scripting flaw that allows an attacker to inject arbitrary client‑side scripts into the wishlist pages of affected WordPress sites. By leveraging user‑controlled input fields that are not properly sanitized, a remote attacker can execute malicious JavaScript in the context of any visitor to the site, potentially leading to credential theft, session hijack, or malicious redirects. This weakness is classified as CWE‑79, a classic reflected XSS attack.

The flaw affects the Premmerce Wishlist for WooCommerce plugin for WordPress, specifically all released versions up to and including 1.1.13. The latest patched release, 1.1.15, removes the vulnerability. Sites running earlier versions of the plugin should update promptly to avoid exploitation.

The CVSS base score of 7.1 indicates a medium vulnerability with potential confidentiality and integrity impact. Although the EPSS score is not available, the flaw is unauthenticated and can be triggered by any external actor, making it highly likely to be targeted. The vulnerability is not listed in the CISA KEV catalog, but its well‑known XSS nature and the lack of input validation make it a priority for rapid remediation.