Login Request a demo
Medium severity · published Dec 13, 2025
CVE-2025-9207
TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
TI WooCommerce Wishlist · templateinvaders
through 2.10.0 · source: vendor
Affected product
TW
TI WooCommerce Wishlist
templateinvaders
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9207
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L326
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/ti-woocommerce-wishlist/trunk/includes/wishlist.class.php#L544
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399224%40ti-woocommerce-wishlist&new=3399224%40ti-woocommerce-wishlist&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/8d08d381-d0ef-4f40-975d-51e919a7c872?source=cve
More from TI WooCommerce Wishlist
10.0
CVE-2025-47577
WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
9.8
CVE-2024-43917
WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability
9.8
CVE-2022-0412
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before…
8.1
CVE-2020-36725
TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update
7.5
CVE-2024-10567
TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access