TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

CVE-2026-120855

The TI WooCommerce Wishlist (ti-woocommerce-wishlist) plugin, versions from n/a through 2.14.0 , is vulnerable to Stored Cross-site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious script...

CVE-2026-120855

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0...

EUVD-2026-119986

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0...

WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection

In the latest version 2.8.2 as of writing the article and below, the plugin is vulnerable to a SQL injection vulnerability that allows any users to execute arbitrary SQL queries in the database of the WordPress site. No privileges are required to exploit the issue. The vulnerability is unpatched ...

WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection

WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...

CVE-2026-109925

The Productive Commerce WordPress plugin versions before 1.1.54 are vulnerable to an unauthenticated SQL injection (SQLi). The root cause is the failure to properly sanitise and escape a parameter used within a SQL statement, specifically affecting the Wishlist and Compare Handlers . Attackers ca...

CVE-2026-109925 Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

truegaze

truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...

CVE-2026-119511

Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3...

CVE-2026-119510

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3...

CVE-2026-119511 WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3...

EUVD-2026-119019

Missing Authorization vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3...

CVE-2026-119511

The MC Woocommerce Wishlist plugin (smart-wishlist-for-more-convert) for WordPress is vulnerable to a Broken Access Control issue in versions up to and including 2.0.3 . The root cause is a Missing Authorization vulnerability that allows for the exploitation of incorrectly configured access contr...

WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dcs in WordPress Plugin MC Woocommerce Wishlist versions = 2.0.3...

CVE-2026-119510

The MC Woocommerce Wishlist (smart-wishlist-for-more-convert) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 2.0.3 . Exploitation details are not provi...

EUVD-2026-119012

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3...

CVE-2026-119510 WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3...

WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by mroccon in WordPress Plugin MC Woocommerce Wishlist versions = 2.0.3...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist for uploaded image path 💾 Saves valid uploaded image URLs to result.txt 💾 Saves valid wishlist URLs to resultwishlist.txt 🧠 Researcher Credit: Patchstack Database 🚀 Usage 1. Prepare your list.txt file with a list of target domains one per line,...