Medium severity5.4NVD Advisory· Published Mar 28, 2022· Updated Jun 17, 2026

CVE-2022-0397

Description

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpclever/Wpc Smart Wishlist For Woocommerce
cpe:2.3:a:wpclever:wpc_smart_wishlist_for_woocommerce:*:*:*:*:*:wordpress:*:*
Range: <2.9.4
WordPress/Nc Wishlist For Woocommercecpe-rescue
Package: https://wordpress.org/plugins/nc-wishlist-for-woocommerce
WordPress/WPC Smart Wishlist for WooCommercellm-fuzzy
Range: <2.9.4

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c8091254-1ced-4363-ab7f-5b880447713dnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000