truegaze

truegaze A static analysis tool for Android and iOS applications focusing on security issues outside the source code such as resource strings, third party libraries and configuration files. Requirements Python 3 is required and you can find all required modules in the requirements.txt file. Only...

WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection

In the latest version 2.8.2 as of writing the article and below, the plugin is vulnerable to a SQL injection vulnerability that allows any users to execute arbitrary SQL queries in the database of the WordPress site. No privileges are required to exploit the issue. The vulnerability is unpatched ...

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

CVE-2022-31101

CVE-2022-31101 Exploit for PrestaShop bockwishlist module 2.1.0 SQLi CVE-2022-31101 Usage python3 cve-2022-31101.py Give the url to the wishlist when prompted. Example of a url: http://example.com/module/blockwishlist/view?idwishlist=1 Give the cookies for your account when prompted. Now it will...

CVE-2024-43917

CVE-2024-43917 This script demonstrates an SQL injection vulnerability found in the TI WooCommerce Wishlist plugin for WordPress, versions up to 2.8.2 CVE-2024-43917. The vulnerability allows unauthenticated users to execute arbitrary SQL commands on the website’s database, potentially exposing...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist for uploaded image path 💾 Saves valid uploaded image URLs to result.txt 💾 Saves valid wishlist URLs to resultwishlist.txt 🧠 Researcher Credit: Patchstack Database 🚀 Usage 1. Prepare your list.txt file with a list of target domains one per line,...

CVE-2026-127213

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...

CVE-2026-127213

The LearnPress Course Wishlist Add-on before version 4.1.2 is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the render_button callback uses a user-supplied user_id parameter instead of verifying the session identity. Attackers can exploit the publicly accessib...

CVE-2026-127213 LearnPress Course Wishlist < 4.1.2 IDOR via render_button

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...

EUVD-2026-125724

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...

CVE-2025-47577

CVE-2025-47577 A proof of concept developed to exploit CVE-2025-47577. Based on PatchStack's article. Usage usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list...

CVE-2026-124763

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site for example by changin...

CVE-2026-124763

The Woocommerce Wishlist WordPress plugin versions through 1.1.0 is vulnerable to an unauthenticated AJAX action that lacks proper authorisation and CSRF checks . An attacker can exploit this to overwrite any site option with an empty value or an uploaded image URL. This could result in site brea...

CVE-2026-124763 AM Wishlist <= 1.1.0 - Unauthenticated Option Overwrite via amwl_upload_file

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site for example by changin...

EUVD-2026-124849

The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its unauthenticated AJAX actions, allowing unauthenticated users to overwrite any site option with the URL of an uploaded image or an empty value, breaking the site for example by changin...

WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection

WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...

PT-2026-147141

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user id parameter to the render button callback instead of relying on the session identity...

CVE-2024-43917

CVE-2024-43917 A proof of concept developed to exploit CVE-2024-43917. Based on PatchStack's article. Usage usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wis...

WordPress TI WooCommerce Wishlist plugin < 2.0.7 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Seid Yassin Ali in WordPress Plugin TI WooCommerce Wishlist versions 2.0.7...

CVE-2026-124648

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists...