CVE-2024-43917

CVE-2024-43917 A proof of concept developed to exploit CVE-2024-43917. Based on PatchStack's article. Usage usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wis...

CVE-2025-47577

CVE-2025-47577 A proof of concept developed to exploit CVE-2025-47577. Based on PatchStack's article. Usage usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist for uploaded image path 💾 Saves valid uploaded image URLs to result.txt 💾 Saves valid wishlist URLs to resultwishlist.txt 🧠 Researcher Credit: Patchstack Database 🚀 Usage 1. Prepare your list.txt file with a list of target domains one per line,...

CVE-2024-43917

CVE-2024-43917 This script demonstrates an SQL injection vulnerability found in the TI WooCommerce Wishlist plugin for WordPress, versions up to 2.8.2 CVE-2024-43917. The vulnerability allows unauthenticated users to execute arbitrary SQL commands on the website’s database, potentially exposing...

WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection

WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...

CVE-2026-15261

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists...

EUVD-2026-107080

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists...

CVE-2026-15261 TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists...

CVE-2026-15261 TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists...

CVE-2026-15261

The TI WooCommerce Wishlist WordPress plugin (versions before 2.13.0 ) is vulnerable to an unauthenticated private wishlist disclosure. The root cause is a failure to enforce owner-only access control on the plugin's REST API , even though such controls are present on the front-end. This allows u...

WordPress TI WooCommerce Wishlist plugin < 2.13.0 - Unauthenticated Private Wishlist Disclosure vulnerability

Unauthenticated Private Wishlist Disclosure vulnerability discovered by Duy Tran in WordPress Plugin TI WooCommerce Wishlist versions 2.13.0...

PT-2026-120475

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists...

VulnCheck KEV: CVE-2022-0412

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL...

CVE-2022-0412

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL...

CVE-2025-67929

CVE-2025-67929 corresponds to TI WooCommerce Wishlist (templateinvaders)

CVE-2025-67929 WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through = 2.10.0...

CVE-2025-67929: Missing Authorization

Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through = 2.10.0...

CVE-2025-9207

CVE-2025-9207 affects the TI WooCommerce Wishlist plugin for WordPress. The vulnerability is an HTML injection flaw present in all versions up to and including 2.10.0, caused by accepting values in hidden inputs without proper validation and outputting them without sanitization. This enables unau...

WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Unauthenticated HTML Injection vulnerability

Unauthenticated HTML Injection vulnerability discovered by pimschaaf - Open Roads in WordPress Plugin TI WooCommerce Wishlist versions = 2.10.0...

CVE-2025-9207: Improper Input Validation

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated...