Is TI WooCommerce Wishlist safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (2.14.1). As of 2026-11-04. 11 issues are on record for older versions; version 2.13.0 or newer fixes all of them that state a fix. Keep TI WooCommerce Wishlist on the latest version (2.14.1) and remove it if you do not use it.

Which versions of TI WooCommerce Wishlist are vulnerable?

Known issues on record (newest first): Missing authorization check (older than 2.13.0, fixed in 2.13.0); Missing authorization check (2.10.0 and older, fixed in 2.11.0); Content injection (2.10.0 and older, fixed in 2.11.0); Arbitrary file upload (2.9.2 and older, fixed in 2.10.0); Stored cross-site scripting (XSS) (2.10.0 and older, fixed in 2.11.0); Missing authorization check (2.9.1 and older, fixed in 2.9.2). The full list with sources is on this page.

What is the latest version of TI WooCommerce Wishlist?

2.14.1, according to wordpress.org (last updated 2026-11-02). It has 100,000+ active installs.

What should I do if my TI WooCommerce Wishlist is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update ti-woocommerce-wishlist). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · ti-woocommerce-wishlist · data as of 2026-11-04

Is TI WooCommerce Wishlist safe? Known vulnerabilities and latest version

Latest version: 2.14.1
Last updated: 2026-11-02
Active installs: 100,000+
Known issues on record: 11
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 7.4+

Boost your sales with a free WooCommerce Wishlist feature. Let your customers save and share their favorite products! — by templateinvaders

What to do

Update to the latest version (2.14.1). Anything older than 2.13.0 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get ti-woocommerce-wishlist --field=version shows what you run; wp plugin update ti-woocommerce-wishlist updates it.

Check your version

Known vulnerabilities

11 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 5.3 CVE-2026-15261 · published 2026-10-21

Missing authorization check in TI WooCommerce Wishlist (older than 2.13.0)

Affected: older than 2.13.0
Fixed in: 2.13.0
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.

NVD CVE-2026-15261 WPScan advisory

medium 5.3 CVE-2025-67929 · published 2025-12-16

Missing authorization check in TI WooCommerce Wishlist (2.10.0 and older)

Affected: 2.10.0 and older
Fixed in: 2.11.0
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

NVD CVE-2025-67929 Patchstack advisory

medium 5.3 CVE-2025-9207 · published 2025-12-13

Content injection in TI WooCommerce Wishlist (2.10.0 and older)

Affected: 2.10.0 and older
Fixed in: 2.11.0 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items.

NVD CVE-2025-9207 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2025-58247 · published 2025-09-22

Missing authorization check in TI WooCommerce Wishlist (2.10.0 and older)

Affected: 2.10.0 and older
Fixed in: 2.11.0
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-58247 Patchstack advisory

critical 10.0 CVE-2025-47577 · published 2025-05-19

Arbitrary file upload in TI WooCommerce Wishlist (2.9.2 and older)

Affected: 2.9.2 and older
Fixed in: 2.10.0
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.

NVD CVE-2025-47577 Patchstack advisory

medium 6.5 CVE-2025-32920 · published 2025-05-19

Stored cross-site scripting (XSS) in TI WooCommerce Wishlist (2.10.0 and older)

Affected: 2.10.0 and older
Fixed in: 2.11.0
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

NVD CVE-2025-32920 Patchstack advisory

high 7.5 CVE-2024-10567 · published 2024-12-04

Missing authorization check in TI WooCommerce Wishlist (2.9.1 and older)

Affected: 2.9.1 and older
Fixed in: 2.9.2 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates.

NVD CVE-2024-10567 Wordfence advisory Code change (fix)

high 7.5 CVE-2024-9156 · published 2024-10-10

SQL injection in TI WooCommerce Wishlist (2.8.2 and older)

Affected: 2.8.2 and older
Fixed in: 2.9.0 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD CVE-2024-9156 WPScan advisory

critical 9.8 CVE-2024-43917 · published 2024-08-29

SQL injection in TI WooCommerce Wishlist (2.8.2 and older)

Affected: 2.8.2 and older
Fixed in: 2.9.0 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.

NVD CVE-2024-43917 Patchstack advisory

high 8.1 CVE-2020-36725 · published 2023-06-07

Missing authorization check in TI WooCommerce Wishlist (1.21.11 and older)

Affected: 1.21.11 and older
Fixed in: 1.21.12 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.

NVD CVE-2020-36725 Wordfence advisory WPScan advisory blog.nintechnet.com templateinvaders.com

critical 9.8 CVE-2022-0412 · published 2022-02-28

SQL injection in TI WooCommerce Wishlist (older than 1.40.1)

Affected: older than 1.40.1
Fixed in: 1.40.1
Access needed (per CVSS): No login needed
Range from: NVD analysis · score by NVD

Details from the advisory

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks

NVD CVE-2022-0412 WPScan advisory Code change (fix)

Recent activity

2026-11-02 — latest release on wordpress.org (2.14.1).
2026-10-21 — Missing authorization check disclosed (CVE-2026-15261), fixed in 2.13.0.
2025-12-16 — Missing authorization check disclosed (CVE-2025-67929), fixed in 2.11.0.
2025-12-13 — Content injection disclosed (CVE-2025-9207), fixed in 2.11.0.

Free. We check the CVE feeds every day and email you only when a new issue for TI WooCommerce Wishlist (ti-woocommerce-wishlist) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (5) · SQL injection (3) · Content injection (1) · Arbitrary file upload (1) · Cross-site scripting (XSS) (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/ti-woocommerce-wishlist (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/ti-woocommerce-wishlist"><img src="https://laskyr.com/plugins/ti-woocommerce-wishlist/badge.svg" alt="TI WooCommerce Wishlist vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is TI WooCommerce Wishlist safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (2.14.1)

What to do

Check your version

Known vulnerabilities

Missing authorization check in TI WooCommerce Wishlist (older than 2.13.0)

Missing authorization check in TI WooCommerce Wishlist (2.10.0 and older)

Content injection in TI WooCommerce Wishlist (2.10.0 and older)

Missing authorization check in TI WooCommerce Wishlist (2.10.0 and older)

Arbitrary file upload in TI WooCommerce Wishlist (2.9.2 and older)

Stored cross-site scripting (XSS) in TI WooCommerce Wishlist (2.10.0 and older)

Missing authorization check in TI WooCommerce Wishlist (2.9.1 and older)

SQL injection in TI WooCommerce Wishlist (2.8.2 and older)

SQL injection in TI WooCommerce Wishlist (2.8.2 and older)

Missing authorization check in TI WooCommerce Wishlist (1.21.11 and older)

SQL injection in TI WooCommerce Wishlist (older than 1.40.1)

Recent activity

Get an email when TI WooCommerce Wishlist has a new vulnerability

Browse vulnerabilities

Where this data comes from