Plugins · smart-wishlist-for-more-convert · data as of 2026-11-04
Is MoreConvert Wishlist for WooCommerce safe? Known vulnerabilities and latest version
- Latest version
- 2.0.4
- Last updated
- 2026-11-02
- Active installs
- 8,000+
- Known issues on record
- 8
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 7.4+
Free: WC Wishlist, Email automation, Elementor Widgets. Premium: Back-in-Stock Notifier, Save for Later, Multi-lists, Reports, Email Marketing. — by Moreconvert Team
What to do
- Update to the latest version (2.0.4). Anything older than 2.0.0 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get smart-wishlist-for-more-convert --field=version shows what you run; wp plugin update smart-wishlist-for-more-convert updates it.
Check your version
Known vulnerabilities
8 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
high 7.6 CVE-2026-66631 · published 2026-09-17
SQL injection in MoreConvert Wishlist for WooCommerce (1.9.21 and older)
- Affected
- 1.9.21 and older
- Fixed in
- 2.0.0
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.
high 7.1 CVE-2026-57356 · published 2026-07-02
Cross-site scripting (XSS) in MoreConvert Wishlist for WooCommerce (1.9.19 and older)
- Affected
- 1.9.19 and older
- Fixed in
- 1.9.20
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.
critical 9.8 CVE-2026-5722 · published 2026-05-05
Authentication bypass in MoreConvert Wishlist for WooCommerce (1.9.14 and older)
- Affected
- 1.9.14 and older
- Fixed in
- 1.9.15 *
- Access needed (per CVSS)
- No login needed
- Range from
- advisory text · score by Wordfence
Details from the advisory
The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.9.14. This is due to the guest waitlist verification flow not invalidating or regenerating verification tokens when the customer email address is changed. This makes it possible for unauthenticated attackers to authenticate as existing users, including administrators, by obtaining a valid guest verification token for an attacker-controlled email, changing the same guest customer email to the target account email through the public waitlist flow, and then using the original verification link.
NVD CVE-2026-5722Wordfence advisorywordpress.orgmoreconvert.com
high 7.1 CVE-2025-47487 · published 2025-06-09
Reflected cross-site scripting (XSS) in MoreConvert Wishlist for WooCommerce (1.9.1 and older)
- Affected
- 1.9.1 and older
- Fixed in
- 1.9.2
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Reflected XSS.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.9.1.
high 7.6 CVE-2025-30879 · published 2025-03-27
SQL injection in MoreConvert Wishlist for WooCommerce (1.8.9 and older)
- Affected
- 1.8.9 and older
- Fixed in
- 1.9.0
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows SQL Injection.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.8.9.
high 7.5 CVE-2024-13694 · published 2025-01-30
Missing authorization check in MoreConvert Wishlist for WooCommerce (1.8.7 and older)
- Affected
- 1.8.7 and older
- Fixed in
- 1.8.8 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to.
NVD CVE-2024-13694Wordfence advisoryCode change (fix)wordpress.orgPlugin source
medium 5.3 CVE-2024-34819 · published 2024-06-11
Missing authorization check in MoreConvert Wishlist for WooCommerce (1.7.2 and older)
- Affected
- 1.7.2 and older
- Fixed in
- 1.7.3
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.7.2.
medium 5.3 CVE-2024-34813 · published 2024-06-11
Missing authorization check in MoreConvert Wishlist for WooCommerce (1.7.8 and older)
- Affected
- 1.7.8 and older
- Fixed in
- 1.7.9
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.7.8.
Recent activity
- 2026-11-02 — latest release on wordpress.org (2.0.4).
- 2026-09-17 — SQL injection disclosed (CVE-2026-66631), fixed in 2.0.0.
- 2026-07-02 — Cross-site scripting (XSS) disclosed (CVE-2026-57356), fixed in 1.9.20.
- 2026-05-05 — Authentication bypass disclosed (CVE-2026-5722), fixed in 1.9.15.
Get an email when MoreConvert Wishlist for WooCommerce has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for MoreConvert Wishlist for WooCommerce (smart-wishlist-for-more-convert) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
Types found in this plugin: Missing authorization (3) · SQL injection (2) · Cross-site scripting (XSS) (2) · Authentication bypass (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/smart-wishlist-for-more-convert (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/smart-wishlist-for-more-convert"><img src="https://laskyr.com/plugins/smart-wishlist-for-more-convert/badge.svg" alt="MoreConvert Wishlist for WooCommerce vulnerability status"></a>