CVE-2026-125746

MediumCVSS 5.3/10Last modified Nov 11, 2026

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1257475.4ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.php that allows authenticated us CVE-2026-1257484.3Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticate CVE-2026-1257494.2TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticate CVE-2026-125757.5DVP80ES3 with Improper Resource Shutdown or Release vulnerability.CVE-2026-1257507.1Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets b CVE-2026-1257513.1Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to appl CVE-2026-1257525.0Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whos CVE-2026-1257535.9ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalcula CVE-2026-1257547.1Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class CVE-2026-1257556.5Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments be CVE-2026-1257565.9postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace CVE-2026-1257579.1mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute comm