TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection

WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist 中已上传图片的路径 💾 将有效的已上传图片 URL 保存到 result.txt 💾 将有效的愿望清单 URL 保存到 resultwishlist.txt 🧠 研究人员 致谢：Patchstack Database 🚀 使用方法 1. 准备 list.txt 文件，其中包含目标域名列表（每行一个，不带 http）。 2. 将要上传的文件（例如 hinata.jpg）放在同一文件夹中。 3. 运行脚本： root@kitploit: python3 CVE-2025-47577.py 示...

CVE-2025-47577

CVE-2025-47577 针对 CVE-2025-47577 开发的概念验证代码。基于 PatchStack 的 文章。 使用方法 root@kitploit: usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list PRODUCTID ID of the...

CVE-2024-43917

CVE-2024-43917 一个概念验证，用于利用 CVE-2024-43917。基于 PatchStack 的文章。 使用方法 root@kitploit: usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wish list optional arguments:...

CVE-2026-82305

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

EUVD-2026-75965

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

CVE-2026-82305 YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

CVE-2026-82305

The YITH WooCommerce Wishlist WordPress plugin (versions before 4.18.1 ) contains an authorization bypass in the change_wishlist_title function, which fails to verify that a user is permitted to rename a given wishlist. This allows unauthenticated attackers to rename any wishlist on the site, res...

WordPress YITH WooCommerce Wishlist plugin < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename vulnerability

Unauthenticated Arbitrary Wishlist Rename vulnerability discovered by Abdullah Kareem in WordPress Plugin YITH WooCommerce Wishlist versions 4.18.1...

CVE-2024-43917

CVE-2024-43917 此脚本演示了在 WordPress 的 TI WooCommerce Wishlist 插件（版本至 2.8.2）中发现的一个 SQL 注入漏洞（CVE-2024-43917）。该漏洞允许未经身份验证的用户在网站数据库上执行任意 SQL 命令，可能暴露敏感信息，如用户名和密码。 用法 安装所需的 Python 依赖： bash pip install requests 将脚本中的 targeturl 替换为易受攻击网站的 URL。 运行脚本： bash root@kitploit: python exploit.py 免责声明...

CVE-2026-57356

Unauthenticated Cross Site Scripting XSS in MC Woocommerce Wishlist = 1.9.19 versions...

CVE-2026-57356

CVE-2026-57356 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress MC Woocommerce Wishlist plugin version ≤ 1.9.19. The issue, identified in the CVE record, does not specify exploitation status or a confirmed fix within the provided documents. The CVSS base scor...

EUVD-2026-41355

Unauthenticated Cross Site Scripting XSS in MC Woocommerce Wishlist = 1.9.19 versions...

CVE-2026-57356 WordPress MC Woocommerce Wishlist plugin <= 1.9.19 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MC Woocommerce Wishlist = 1.9.19 versions...

CVE-2026-57356

Unauthenticated Cross Site Scripting XSS in MC Woocommerce Wishlist = 1.9.19 versions...

CVE-2026-4432

The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the savetitle AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page,...

CVE-2026-27329

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0...

EUVD-2026-28334

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0...

CVE-2026-27329

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Wishlist: from n/a through 4.12.0...