CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist for uploaded image path 💾 Saves valid uploaded image URLs to result.txt 💾 Saves valid wishlist URLs to resultwishlist.txt 🧠 Researcher Credit: Patchstack Database 🚀 Usage 1. Prepare your list.txt file with a list of target domains one per line,...

CVE-2024-43917

CVE-2024-43917 A proof of concept developed to exploit CVE-2024-43917. Based on PatchStack's article. Usage usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wis...

WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection

WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint. id: CVE-2022-0412 info: name: WordPress TI WooCommerce...

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

CVE-2024-43917

CVE-2024-43917 This script demonstrates an SQL injection vulnerability found in the TI WooCommerce Wishlist plugin for WordPress, versions up to 2.8.2 CVE-2024-43917. The vulnerability allows unauthenticated users to execute arbitrary SQL commands on the website’s database, potentially exposing...

CVE-2025-47577

CVE-2025-47577 A proof of concept developed to exploit CVE-2025-47577. Based on PatchStack's article. Usage usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list...

CVE-2026-66631

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

EUVD-2026-81511

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

CVE-2026-66631

CVE-2026-66631 affects the MC Woocommerce Wishlist WordPress plugin (plugin slug: smart-wishlist-for-more-convert ) in versions

CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MC Woocommerce Wishlist versions = 1.9.21...

CVE-2026-66631: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

PT-2026-94277

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

VulnCheck KEV: CVE-2022-0412

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL...

CVE-2026-82305

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

EUVD-2026-75965

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

WordPress YITH WooCommerce Wishlist plugin < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename vulnerability

Unauthenticated Arbitrary Wishlist Rename vulnerability discovered by Abdullah Kareem in WordPress Plugin YITH WooCommerce Wishlist versions 4.18.1...

CVE-2026-82305

The YITH WooCommerce Wishlist WordPress plugin (versions before 4.18.1 ) contains an authorization bypass vulnerability. The flaw exists because the plugin fails to verify if a user is authorized to rename a wishlist, specifically via the change_wishlist_title functionality. This allows unauthent...

CVE-2026-82305 YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...