CVE-2022-0397: Wpclever Wpc Smart Wishlist For Woocommerce

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting

Affected products

• Wpclever Wpc Smart Wishlist For Woocommerce: before 2.9.4 (fixed in 2.9.4)

Published 2022-03-28. Last modified 2026-06-17.