← back to popular plugins
wordfence / plugin · woo-smart-wishlist
WPC Smart Wishlist for WooCommerce
woo-smart-wishlist
total installs
100,000
total vulns
3
critical
0
high
0
medium
3
low
0
latest vuln
—
patched
3
unpatched
0
avg time to patch
—
vulnerabilities
(3)
WPC Smart Wishlist for WooCommerce <= 5.0.8 - Missing Authorization
medium
✓ patched
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.0.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
medium
✓ patched
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information.
WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
medium
✓ patched
cve id
CVE-2025-11518 ↗
cvss score
5.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Oct 10, 2025
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it possible for unauthenticated attackers to empty and add to other user's wishlists, if they have access to the key.