Pickplugins Wishlist vulnerabilities
6 vulnerabilities
Known vulnerabilities in Pickplugins Wishlist, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2025-26915pickplugins · wishlist +1 moreWordPress Wishlist Plugin <= 1.0.41 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.41.EPSS0.42%HighCVE-2025-24655pickplugins · wishlist +1 moreWordPress Wishlist Plugin <= 1.0.39 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through <= 1.0.39.EPSS0.29%MediumCVE-2025-49075pickplugins · wishlist +1 moreWordPress Wishlist plugin <= 1.0.43 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Stored XSS.This issue affects Wishlist: from n/a through <= 1.0.43.EPSS0.20%HighCVE-2025-32618pickplugins · wishlist +1 moreWordPress Wishlist plugin <= 1.0.46 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.46.EPSS0.50%MediumCVE-2025-32272pickplugins · wishlist +1 moreWordPress Wishlist plugin <= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a through <= 1.0.46.EPSS0.19%MediumCVE-2024-12809pickplugins · wishlist +1 moreWishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions up to, and including, 1.0.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.31%