Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Wishlistwishlist-member-xTI WooCommerce WishlistMoreConvert ProYITH WooCommerce WishlistWishlist for WooCommerceWPC Smart Wishlist for WooCommercepremmerce-woocommerce-wishlist
Plugin · ti-woocommerce-wishlist
TI WooCommerce Wishlist
9 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 21, 2026TI WooCommerce Wishlist: Does not enforce the same owner-only access control on its REST API that it applies on the front-endCVE-2026-15261 · fixed in 2.13.0 · reported by WPScanMedium 5.3
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
Dec 16, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-67929 · affects up to 2.10.0 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
Dec 13, 2025TI WooCommerce Wishlist: HTML InjectionCVE-2025-9207 · affects up to 2.10.0 · reported by WordfenceMedium 5.3
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-58247 · affects up to 2.10.0 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
May 19, 2025TI WooCommerce Wishlist: Unrestricted Upload of File with Dangerous TypeCVE-2025-47577 · affects up to 2.9.2 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.
May 19, 2025TI WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32920 · affects up to 2.10.0 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
Dec 4, 2024TI WooCommerce Wishlist: Unauthorized modification of dataCVE-2024-10567 · affects up to 2.9.1 · reported by WordfenceHigh 7.5
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates.
Oct 10, 2024TI WooCommerce Wishlist: Is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL queryCVE-2024-9156 · affects up to 2.8.2 · reported by WPScanHigh 7.5
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Aug 29, 2024TI WooCommerce Wishlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43917 · affects up to 2.8.2 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.