CVE-2026-97273

Executive Summary

CVE-2026-97273 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Premmerce Wishlist plugin for WooCommerce, versions 1.1.13 and earlier. The flaw carries a CVSS v3.1 base score of 7.1 (High) and permits a remote, unauthenticated attacker to inject arbitrary script that executes in the context of a victim's browser. Because the plugin is embedded within WooCommerce storefronts, successful exploitation can compromise customer sessions, manipulate or steal authentication state, and enable further attacks against store administrators and shoppers.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly "Cross-Site Scripting"). The NVD description states the issue is an unauthenticated XSS in Premmerce Wishlist for WooCommerce affecting versions <= 1.1.13.

Two characteristics are decisive for the risk posture:

1. Unauthenticated trigger. The PR:N (Privileges Required: None) component of the CVSS vector confirms that no valid session or account is needed to deliver the malicious input. The attacker only needs network reachability to the affected storefront.

2. User interaction required. The UI:R (User Interaction: Required) component indicates that some victim action — for example, visiting a crafted URL or loading a page that reflects/renders attacker-controlled content — is necessary for the script to execute. This is consistent with a reflected or DOM-based XSS pattern typical of WordPress/WooCommerce plugin input-handling flaws.

The CVSS subscores further characterise the flaw:

• Scope Changed (S:C). Exploitation crosses a trust boundary: script execution may affect resources beyond the vulnerable component itself (e.g., the parent storefront origin, admin session, or other plugin-controlled DOM).
• Confidentiality (L), Integrity (L), Availability (L) — all Low. Impact is real but bounded, reflecting typical XSS outcomes: theft of client-side data, unauthorised state changes in the victim's authenticated context, and possible disruption of page functionality.

Important accuracy note: The available description does not disclose the specific vulnerable parameter, hook, AJAX action, endpoint, or source file/path. This report therefore analyses the vulnerability at the class level and does not fabricate function names, route names, or parameters. No public proof-of-concept, exploit code, or Nuclei template is available as of this writing.

Because Premmerce Wishlist integrates directly into WooCommerce archives, single-product pages, and the cart flow, affected deployments inherit the plugin's attack surface across all pages where wishlist rendering occurs. The precise injection vector cannot be confirmed from the data supplied; it should be determined empirically by the defending team via plugin source review (input sources are typically query strings, POST bodies, or REST/AJAX request data reflected into wishlist output).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (unauthenticated reflected/DOM XSS) and the CVSS vector. No specific function names, endpoints, or parameters are asserted.

1) Reconnaissance / target identification. An attacker identifies WooCommerce sites running Premmerce Wishlist via plugin fingerprinting (HTML markers, public asset paths, or passive scanning). Internet-exposed storefronts are the candidate population.

2) Triggering the flaw class. Because the issue is unauthenticated, the attacker crafts a request containing script-bearing input to a plugin-handled request path. Under a reflected XSS model, the malicious value is supplied in a request (e.g., a URL) and is returned/rendered into the response HTML without adequate output encoding or input sanitisation, causing the browser to interpret it as executable script. Under a DOM-based model, attacker-controlled data reaches an unsafe client-side sink.

3) Payload / execution at the class level. The payload is a script fragment (e.g., a <script> element or an event-handler attribute) that, when rendered by the victim's browser, executes in the origin of the affected storefront. Execution requires the victim to interact with the crafted page or link (consistent with UI:R).

4) Post-exploitation impact. Successful execution allows the attacker, operating in the victim's browser context, to perform actions available to that user and to read data accessible to the page — consistent with the Changed scope (S:C). Typical consequences include session/token theft, DOM manipulation, drive-by redirection, credential phishing overlays, and unauthorised operations within the WooCommerce session. No elevated server-side access is implied by the CVSS subscores.

Impact Assessment

• Confidentiality: Low. Potential exposure of client-side data available to the rendered page, which may include session material enabling account takeover.
• Integrity: Low. Ability to alter page content or perform actions in the victim's session.
• Availability: Low. Possible disruption of storefront functionality via injected script.
• Scope: Changed. The vulnerability's effect can extend beyond the vulnerable component to the encompassing storefront origin and adjacent resources — increasing the practical blast radius versus a scope-unchanged XSS.
• Business impact. For WooCommerce merchants, compromise of shopper sessions can lead to fraudulent transactions, credential theft, data exposure, and reputational and regulatory damage (e.g., privacy obligations around customer PII). Administrators interacting with affected pages risk elevated-role session compromise.
• Blast radius. Any internet-reachable WooCommerce deployment running Premmerce Wishlist <= 1.1.13. The unauthenticated trigger (PR:N) removes account prerequisites, broadening the exploitable population.
• EPSS. Not yet scored by FIRST.org — no exploitation-probability estimate is available.
• CISA KEV. Not listed; no confirmed exploitation in the wild at time of writing.

Detection Guidance

Sigma Rule

title: Potential Premmerce Wishlist WooCommerce Unauth XSS Exploitation Attempt
id: 4b2f9c1e-7a3d-4e58-9f21-premmerce-97273
status: experimental
description: Detects requests to WooCommerce storefronts containing script-like payloads in query parameters, indicative of unauthenticated XSS probing against Premmerce Wishlist (CVE-2026-97273).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97273
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'document.cookie'
  condition: selection_method and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate security scanners
  - Benign parameters containing the word "script"
level: medium
tags:
  - attack.t1059.007
  - cve.2026.97273

YARA Rule

rule CVE_2026_97273_XSS_Payload
{
    meta:
        description = "Detects common reflected XSS payload patterns associated with CVE-2026-97273 (Premmerce Wishlist for WooCommerce)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97273"
        cve = "CVE-2026-97273"

    strings:
        $xss1 = "<script>" nocase
        $xss2 = "</script>" nocase
        $xss3 = "javascript:" nocase
        $xss4 = "onerror=" nocase
        $xss5 = "onload=" nocase
        $xss6 = "document.cookie" nocase
        $xss7 = "alert(" nocase

    condition:
        uint16(0) == 0x3C3F or any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97273 Premmerce Wishlist WooCommerce Unauthenticated XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"<script"; nocase; sid:90097273; rev:1; reference:cve,2026-97273; classtype:web-application-attack; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-97273 Premmerce Wishlist XSS Payload (URL-encoded)"; flow:established,to_server; http.uri; content:"%3Cscript"; nocase; sid:90097274; rev:1; reference:cve,2026-97273; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET","POST")
      and wildcard(http.request.uri.query, "*<script*") ]
  [ network where http.request.method in ("GET","POST")
      and wildcard(http.request.uri.query, "*document.cookie*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lc = lower(uri)
| where match(uri_lc, "<script|%3cscript|javascript:|onerror=|document\.cookie")
| stats count values(uri) as uris by src_ip, useragent, status
| where count > 3
| sort -count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-97273,">
  <rule id="100973" level="10">
    <if_sid>31100</if_sid>
    <match>PREMMERCE|WISHLIST|WOOCOMMERCE</match>
    <description>Possible Premmerce Wishlist WooCommerce XSS attack (CVE-2026-97273) detected in web request</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>attack,web_attack,t1059_007,</group>
  </rule>

  <rule id="100974" level="10">
    <if_sid>31100</if_sid>
    <regex_type>pcre2</regex_type>
    <match><![CDATA[`(%3C|<)script|javascript:|\bonerror\s*=|\bonload\s*=`]]></match>
    <description>Possible XSS payload (class CWE-79) in HTTP request to WooCommerce storefront</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source available at time of writing).

1) Immediate mitigations

• Deploy a Web Application Firewall (WAF) or reverse proxy with virtual patching rules targeting reflected XSS patterns in query strings and request bodies. Where no vendor rule exists, add custom rules matching <script, javascript:, event-handler attributes (onerror=, onload=), and URL-encoded equivalents.
• Apply strict output encoding and Content Security Policy (CSP) headers at the storefront edge to reduce the executability of injected script.
• Restrict exposure: if the plugin is not essential, deactivate and remove it until a fix is available. This eliminates the attack surface entirely.
• Enable HttpOnly and Secure flags on session cookies to limit session theft from script execution (reduces impact; does not remediate the flaw).

2) Patch / Upgrade steps

• No fixed version has been released. Monitor the vendor's official plugin repository and release channels for a patched release greater than 1.1.13.
• Once a fixed version ships, update via the WordPress admin (Plugins → update) or WP-CLI (wp plugin update premmerce-wishlist), after staging and validating on a non-production instance.
• Subscribe to the vendor's security advisories and to the WordPress plugin vulnerability feed to be alerted when a patched version becomes available.

3) Long-term hardening

• Maintain a vulnerability management process that tracks third-party WordPress/WooCommerce plugin versions and cross-references them against NVD and plugin-specific feeds.
• Enforce least privilege for administrative sessions; restrict admin actions to trusted networks where feasible.
• Adopt a defence-in-depth posture (CSP, WAF, input validation at plugin integrations) that does not depend solely on vendor patches.
• Include client-side/XSS vectors in regular penetration testing of e-commerce platforms, and rehearse incident response for web-origin compromise.

References

• NVD — CVE-2026-97273: https://nvd.nist.gov/vuln/detail/CVE-2026-97273
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• FIRST EPSS (not yet scored for this CVE at time of writing): https://api.first.org/data/v1/epss
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-97273 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• WordPress Plugin Security / Premmerce Wishlist for WooCommerce (vendor release channel — monitor for patched version > 1.1.13): https://wordpress.org/plugins/premmerce-wishlist/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-97273 at time of writing. The vulnerability is not in CISA KEV, and no public PoC or Nuclei template is currently available.