CVE-2026-121516 QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qodewishlistforwoocommerceguestsitems' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-121516

The QODE Wishlist for WooCommerce plugin for WordPress (versions up to and including 1.2.9 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the qode_wishlist_for_woocommerce_guests_items parameter. ...