YITH WooCommerce Wishlist

A contributor-level user can store script in a wishlist row id, which the move-to-wishlist popup concatenated into an HTML input attribute. It then runs when another user opens the page. Fixed in 4.6.0.

This vulnerability affects the following application versions:

• YITH WooCommerce Wishlist 3.0.0
• YITH WooCommerce Wishlist 3.0.2
• YITH WooCommerce Wishlist 3.0.3
• YITH WooCommerce Wishlist 3.0.4
• YITH WooCommerce Wishlist 3.0.5
• YITH WooCommerce Wishlist 3.0.6
• YITH WooCommerce Wishlist 3.0.7
• YITH WooCommerce Wishlist 3.0.8
• YITH WooCommerce Wishlist 3.0.9
• YITH WooCommerce Wishlist 3.0.10
• YITH WooCommerce Wishlist 3.0.11
• YITH WooCommerce Wishlist 3.0.12
• YITH WooCommerce Wishlist 3.0.13
• YITH WooCommerce Wishlist 3.0.14
• YITH WooCommerce Wishlist 3.0.15
• YITH WooCommerce Wishlist 3.0.16
• YITH WooCommerce Wishlist 3.0.17
• YITH WooCommerce Wishlist 3.0.18
• YITH WooCommerce Wishlist 3.0.19
• YITH WooCommerce Wishlist 3.0.20
• YITH WooCommerce Wishlist 3.0.21
• YITH WooCommerce Wishlist 3.0.22
• YITH WooCommerce Wishlist 3.0.23
• YITH WooCommerce Wishlist 3.0.25
• YITH WooCommerce Wishlist 3.1.0
• YITH WooCommerce Wishlist 3.1.1
• YITH WooCommerce Wishlist 3.2.0
• YITH WooCommerce Wishlist 3.3.0
• YITH WooCommerce Wishlist 3.4.0
• YITH WooCommerce Wishlist 3.5.0
• YITH WooCommerce Wishlist 3.6.0
• YITH WooCommerce Wishlist 3.7.0
• YITH WooCommerce Wishlist 3.8.0
• YITH WooCommerce Wishlist 3.9.0
• YITH WooCommerce Wishlist 3.10.0
• YITH WooCommerce Wishlist 3.11.0
• YITH WooCommerce Wishlist 3.12.0
• YITH WooCommerce Wishlist 3.13.0
• YITH WooCommerce Wishlist 3.14.0
• YITH WooCommerce Wishlist 3.15.0
• YITH WooCommerce Wishlist 3.16.0
• YITH WooCommerce Wishlist 3.17.0
• YITH WooCommerce Wishlist 3.18.0
• YITH WooCommerce Wishlist 3.19.0
• YITH WooCommerce Wishlist 3.20.0
• YITH WooCommerce Wishlist 3.21.0
• YITH WooCommerce Wishlist 3.22.0
• YITH WooCommerce Wishlist 3.23.0
• YITH WooCommerce Wishlist 3.24.0
• YITH WooCommerce Wishlist 3.25.0
• YITH WooCommerce Wishlist 3.26.0
• YITH WooCommerce Wishlist 3.27.0
• YITH WooCommerce Wishlist 3.28.0
• YITH WooCommerce Wishlist 3.29.0
• YITH WooCommerce Wishlist 3.30.0
• YITH WooCommerce Wishlist 3.31.0
• YITH WooCommerce Wishlist 3.32.0
• YITH WooCommerce Wishlist 3.33.0
• YITH WooCommerce Wishlist 3.34.0
• YITH WooCommerce Wishlist 3.35.0
• YITH WooCommerce Wishlist 3.36.0
• YITH WooCommerce Wishlist 3.37.0
• YITH WooCommerce Wishlist 3.38.0
• YITH WooCommerce Wishlist 4.0.0
• YITH WooCommerce Wishlist 4.0.1
• YITH WooCommerce Wishlist 4.1.0
• YITH WooCommerce Wishlist 4.2.0
• YITH WooCommerce Wishlist 4.3.0
• YITH WooCommerce Wishlist 4.4.0
• YITH WooCommerce Wishlist 4.5.0

YITH WooCommerce Wishlist up to and including 4.10.0 exposes YITH_WCWL_Wishlists::create() through the unauthenticated REST route /wp-json/yith/wishlist/v1/lists, which registers permission_callback => ‘__return_true’. Because create() accepted a caller-supplied user_id without checking who was asking, an unauthenticated attacker could have a wishlist created for, and its token returned for, any user id – disclosing that user’s wishlist token and enabling the attacker to rename the wishlist or delete its items (CVE-2025-12777 and CVE-2025-12427, both CVSS 5.3). Version 4.10.1 adds an ownership check inside create(), throwing YITH_WCWL_Exception unless the current user is the target user or holds the manage_woocommerce capability.

This vulnerability affects the following application versions:

• YITH WooCommerce Wishlist 4.0.0
• YITH WooCommerce Wishlist 4.0.1
• YITH WooCommerce Wishlist 4.1.0
• YITH WooCommerce Wishlist 4.2.0
• YITH WooCommerce Wishlist 4.3.0
• YITH WooCommerce Wishlist 4.4.0
• YITH WooCommerce Wishlist 4.5.0
• YITH WooCommerce Wishlist 4.6.0
• YITH WooCommerce Wishlist 4.7.0
• YITH WooCommerce Wishlist 4.8.0
• YITH WooCommerce Wishlist 4.9.0
• YITH WooCommerce Wishlist 4.10.0