PT-2025-51094 · WordPress · Ti Woocommerce Wishlist

Pim Schaaf · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-9207

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TI WooCommerce Wishlist plugin for WordPress versions prior to 2.10.1

Description The TI WooCommerce Wishlist plugin for WordPress is susceptible to HTML Injection due to the plugin accepting hidden fields and failing to limit input data. This allows unauthenticated attackers to inject arbitrary HTML into wishlist items.

Recommendations Update the TI WooCommerce Wishlist plugin to version 2.10.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-9207

Affected Products

Ti Woocommerce Wishlist

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-9207 · Security Note
• https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L544 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399224%40ti-woocommerce-wishlist&new=3399224%40ti-woocommerce-wishlist&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8d08d381-d0ef-4f40-975d-51e919a7c872?source=cve · Note
• https://t.me/CVEtracker/39707 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L326 · Note
• https://twitter.com/VulmonFeeds/status/1999900687866466405 · Twitter Post
• https://twitter.com/CVEnew/status/1999865333998665953 · Twitter Post