CVE-2026-97268

Executive Summary

CVE-2026-97268 is an unauthenticated reflected/stored Cross-Site Scripting (XSS) vulnerability affecting the Premmerce Wishlist plugin for WooCommerce at versions <= 1.1.13. The flaw has a CVSS v3.1 base score of 7.1 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-reachable, low-complexity, no-privilege attack that requires user interaction and crosses a security boundary (scope change). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's authenticated WordPress/WooCommerce session, potentially leading to session hijacking, credential theft, or modification of wishlist and storefront content.

Technical Analysis

The vulnerability class is CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). CVE-2026-97268 is described as an "Unauthenticated Cross Site Scripting (XSS)" issue in the Premmerce Wishlist for WooCommerce plugin up to and including version 1.1.13.

The key characteristics derivable from the provided data:

• Attack vector: Network (AV:N) — exploitable remotely via HTTP requests to the affected WordPress site.
• Authentication: None required (PR:N) — the description explicitly states "Unauthenticated," meaning the attacker does not need valid WordPress credentials to inject or trigger the payload.
• User interaction: Required (UI:R) — a victim must perform an action (e.g., load a page, click a crafted link) for the payload to execute in their browser.
• Scope: Changed (S:C) — the vulnerable component (the Wishlist plugin) impacts resources beyond its own security scope (e.g., the broader WordPress administrative session).
• Confidentiality/Integrity/Availability: All Low (C:L/I:L/A:L).

Because the NVD description is sparse and does not name specific parameters, endpoints, or functions, the exact injection point cannot be asserted without fabrication. At the vulnerability-class level, XSS in a WooCommerce wishlist plugin typically manifests through unsanitized user-supplied input reflected into an HTML response or stored in a database field later rendered without encoding. Given the "Unauthenticated" qualifier, the most probable mechanism is that a wishlist-related input — passed via a query string, POST body, or AJAX parameter — is echoed back into the page without proper output encoding or HTML sanitization. However, the precise parameter name and rendering context are not disclosed in the available data and are therefore left unspecified here.

The CVSS vector's scope change (S:C) is significant: it implies the injected script can affect resources outside the plugin's origin, such as the WordPress admin dashboard, authentication cookies, or other storefront components sharing the same origin. This elevates the practical risk beyond a simple cosmetic defacement.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-97268. The following attack chain is inferred strictly from the vulnerability class (unauthenticated XSS) and the CVSS vector. No specific parameter names, endpoints, or function names are asserted because they are not present in the source data.

1. Reconnaissance / Target Identification: An attacker identifies WordPress sites running WooCommerce with the Premmerce Wishlist plugin. Fingerprinting is possible by inspecting publicly served asset paths, page source references, or plugin readme files that reveal the plugin and its version (<= 1.1.13). Shodan or similar internet-wide scanners can enumerate candidate hosts via HTTP body signatures.

2. Triggering the Flaw (vulnerability-class level): Because the issue is unauthenticated, the attacker constructs a crafted request to a wishlist-related endpoint or page that causes user-supplied input to be reflected into the HTML response without proper neutralization. Where the XSS is stored rather than reflected, the attacker submits a payload that is persisted (e.g., within a wishlist item attribute) and rendered to other users later. Again, the exact input vector is not specified in the available intelligence.

3. Payload / Execution (vulnerability-class level): The attacker delivers a URL or page containing a JavaScript payload (e.g., a <script> block or event-handler attribute) to a victim. When the victim loads the affected page, the browser executes the attacker-controlled script in the origin of the vulnerable WordPress site. Delivery typically relies on social engineering — phishing links, malicious forum posts, or embedded iframes.

4. Post-Exploitation Impact: Executed in the victim's browser context, the script can read and exfiltrate session cookies or authentication tokens, perform actions on behalf of the victim (such as modifying wishlists, placing cart actions, or, for admin victims, altering site configuration), redirect users to attacker-controlled infrastructure, or inject further malicious content. The scope change (S:C) in the CVSS vector supports the possibility of impacting the broader WordPress session and administrative functions.

Impact Assessment

With a CVSS v3.1 base score of 7.1, CVE-2026-97268 is rated High severity. The subscores are:

• Confidentiality (Low): Possible exposure of session data, cookies, or limited page content accessible to the executing script.
• Integrity (Low): Possible unauthorized modification of wishlist data, storefront content, or user-visible page elements.
• Availability (Low): Potential minor disruption, such as redirects or forced page manipulation, though no data destruction is implied.

Because exploitation requires user interaction (UI:R), mass automated compromise is less likely than with a fully unauthenticated RCE; however, targeted phishing against store administrators or customers can still yield meaningful impact. The unauthenticated nature (PR:N) means attackers need no account on the target site, widening the pool of potential attackers. The scope change (S:C) indicates the blast radius extends beyond the plugin itself, potentially compromising the integrity of the surrounding WordPress/WooCommerce environment and any credentials or sessions processed within that origin.

Affected systems are WordPress installations running the Premmerce Wishlist for WooCommerce plugin at version 1.1.13 or earlier. E-commerce sites are particularly attractive targets because customer sessions and potentially payment-adjacent flows traverse the same origin.

Detection Guidance

Sigma Rule

title: Potential Unauthenticated XSS Exploitation Attempt - Premmerce Wishlist for WooCommerce
id: 8f2c1a44-9726-4cve-9b7a-0000000097268
status: experimental
description: Detects suspicious script-like payloads in HTTP requests targeting WordPress/WooCommerce wishlist functionality, consistent with CVE-2026-97268.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97268
author: Threat Intelligence Team
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript'
      - 'document.cookie'
      - 'alert('
  selection_uri:
    cs-uri-stem|contains:
      - 'wishlist'
      - 'premmerce'
      - 'wc-wishlist'
  condition: selection_method and selection_payload and selection_uri
falsepositives:
  - Legitimate use of the word "wishlist" combined with benign query content
  - Security scanners and fuzzers generating noisy payloads
level: medium
tags:
  - attack.t1059.007
  - cve.2026.97268

YARA Rule

rule CVE_2026_97268_Premmerce_Wishlist_XSS
{
    meta:
        description = "Detects reflected/stored XSS payload patterns associated with CVE-2026-97268 in Premmerce Wishlist for WooCommerce <= 1.1.13"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97268"
        date = "2026-01-01"
        severity = "high"

    strings:
        $xss1 = "<script>" nocase
        $xss2 = "</script>" nocase
        $xss3 = "javascript:" nocase
        $xss4 = "onerror=" nocase
        $xss5 = "onload=" nocase
        $xss6 = "document.cookie" nocase
        $plugin1 = "premmerce" nocase
        $plugin2 = "wishlist" nocase
        $wc = "woocommerce" nocase

    condition:
        filesize < 2MB and
        (2 of ($xss*)) and
        (1 of ($plugin*) or $wc)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97268 Premmerce Wishlist for WooCommerce Unauthenticated XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"wishlist"; nocase; http.uri; content:"<script"; nocase; http.uri; content:"%3Cscript"; nocase; pcre:"/(<script|%3Cscript|javascript:|onerror=|onload=)/iU"; classtype:web-application-attack; reference:cve,2026-97268; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97268; sid:9726801; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Medium;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method in ("GET","POST") and
    http.request.uri : ("*wishlist*" or "*premmerce*") and
    http.request.uri : ("*<script*" or "*javascript:*" or "*onerror=*" or "*document.cookie*")]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| where match(uri, "(?i)(wishlist|premmerce)")
| where match(uri, "(?i)(%3Cscript|<script|javascript:|onerror=|onload=|document\.cookie|alert\()")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as request_uris
        by src_ip, host, status
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count
| table first_seen, last_seen, src_ip, host, status, count, request_uris

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-97268">
  <rule id="972680" level="10">
    <if_sid>31100,31101,31103,31104</if_sid>
    <id>^CVE-2026-97268$</id>
    <description>CVE-2026-97268: Possible unauthenticated XSS attempt against Premmerce Wishlist for WooCommerce (<= 1.1.13)</description>
    <group>web_attack,xss,</group>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>

  <rule id="972681" level="10">
    <if_sid>31100,31103</if_sid>
    <url>wishlist|premmerce</url>
    <match>script|javascript:|onerror=|onload=|document.cookie</match>
    <description>CVE-2026-97268: Suspicious XSS payload targeting wishlist endpoint</description>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, CVE-verified patch version, or official advisory is available in the tracked data.

1. Immediate Mitigations:

   • Deploy a Web Application Firewall (WAF) with virtual patching rules tailored to block XSS payloads (e.g., <script>, javascript:, event-handler attributes, document.cookie) in requests to WordPress/WooCommerce wishlist endpoints.
   • Enforce strict Content Security Policy (CSP) headers that disallow inline scripts and restrict script-src to trusted origins, reducing the impact of successful injection.
   • Set session cookies with HttpOnly and Secure flags to limit cookie theft via client-side JavaScript.
   • Limit exposure by restricting access to non-essential wishlist functionality where feasible.
   • Monitor web and application logs for suspicious payloads targeting wishlist-related URLs.

2. Patch / Upgrade Steps:

   • No official patch exists as of this report. Monitor the Premmerce vendor site, the WordPress plugin repository, and NVD for an updated release addressing CVE-2026-97268.
   • If the plugin is not operationally required, consider disabling or removing it until a fix is available.
   • Track the CVE record at https://nvd.nist.gov/vuln/detail/CVE-2026-97268 for patch status updates.

3. Long-Term Hardening:

   • Maintain an inventory of WordPress plugins and versions; subscribe to vulnerability feeds for WooCommerce ecosystem components.
   • Implement defense-in-depth: input validation, output encoding, and context-aware escaping for all plugin-generated pages.
   • Conduct periodic security reviews and penetration tests of e-commerce storefronts, with focus on third-party plugins.
   • Adopt a content security policy and cookie hardening baseline for all WordPress deployments.
   • Automate plugin update management and vulnerability scanning to shrink exposure windows.

References

• NVD — CVE-2026-97268: https://nvd.nist.gov/vuln/detail/CVE-2026-97268
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• FIRST EPSS — (Not yet scored for CVE-2026-97268; monitor https://api.first.org/data/v1/epss?cve=CVE-2026-97268)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-97268 not listed (verify at https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
• Premmerce official site / WordPress plugin repository — monitor for patched release (no advisory currently available)

Exploit-in-the-wild status: No public PoC, Nuclei template, exploit code, or threat actor campaign is associated with CVE-2026-97268 in the available intelligence. No CISA KEV listing exists.