These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce plugin versions <= 1.1.13. The vulnerability allows attackers to inject malicious scripts, potentially leading to unauthorized actions or data theft. Defenders should verify and update vulnerable plugin versions. The CVE record and NVD entry provide limited information, with the NVD entry currently listed as Deferred.
A critical unauthenticated SQL injection vulnerability exists in Premmerce Wishlist for WooCommerce versions up to 1.1.11. This vulnerability, tracked as CVE-2026-54849, has a CVSS score of 9.3 and is considered critical. The vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or system compromise.
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution (RCE) due to a missing authorization check in the 'generatePluginHandler' function and unsanitized string substitution in the 'createFromStub' function. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary PHP code, leading to RCE.