WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in YITH WooCommerce Wishlist

YITH WooCommerce Wishlist add all Wishlist features to your website. Needs WooCommerce to work. WooCommerce 11.0.x compatible.

8Reported vulnerabilities
6.4Highest CVSS score
4.17.0Latest version
400,000+Active installs

What to do now

Update YITH WooCommerce Wishlist to 4.13.0 or later. 8 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 21, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2025-5238 Medium 6.4 0.3% 0 to 4.5.0 (inclusive) 4.6.0 June 14, 2025
WF-3737d7a0-76d6-4292-aa31-6ee2cb0e9575 Medium 6.1 — 2.1.2 and earlier 2.2.0 January 16, 2018
CVE-2026-27329 Medium 5.3 0.3% 4.12.0 and earlier 4.13.0 May 7, 2026
CVE-2026-4432 Medium 5.3 0.2% Before 4.13.0 4.13.0 March 20, 2026
CVE-2025-12777 Medium 5.3 0.3% 0 to 4.10.0 (inclusive) 4.10.1 November 19, 2025
CVE-2025-12427 Medium 5.3 0.3% 0 to 4.10.0 (inclusive) 4.10.1 November 19, 2025
CVE-2024-34385 Medium 4.4 0.3% 3.32.0 and earlier 3.33.0 May 30, 2024
CVE-2019-16251 Medium 4.3 0.9% 2.2.13 and earlier
2.3.13 and earlier
1.3.13 and earlier
1.3.11 and earlier
1.6.9 and earlier
1.3.19 and earlier
1.3.6 and earlier
1.4.7 and earlier
1.3.4 and earlier
1.2.10 and earlier
1.2.12 and earlier
1.1.9 and earlier
1.3.9 and earlier
1.5.21 and earlier
1.3.7 and earlier
1.6.3 and earlier
1.4.3 and earlier
1.1.15 and earlier
1.7.4 and earlier
1.8.11 and earlier
1.1.6 and earlier
1.1.1 and earlier
1.2.13 and earlier
2.0.1 and earlier
1.0.10 and earlier
1.1.12 and earlier
1.1.11 and earlier
2.1.3 and earlier
3.4.0 and earlier
1.3.2 and earlier
1.2.5 and earlier
1.2.7 and earlier		 1.2.14 October 31, 2019

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.