WordSec
WordSec

Wishlist Member

Explore Wishlist Member vulnerabilities across all versions. Currently tracking 15 known vulnerabilities, including severity, impact, and patch status.

01234567891020.06.2024Today20.06.20245.3WishList Member X < 3.26.7 - Unauthenticated Denial of Service CVSS 5.3 · 20.06.202410.0WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution CVSS 10.0 · 20.06.20248.1WishList Member X < 3.26.7 - Authenticated (Subscriber+) Arbitrary File Deletion CVSS 8.1 · 20.06.20245.3WishList Member X < 3.26.7 - Unauthenticated Information Exposure CVSS 5.3 · 20.06.20247.2WishList Member X < 3.26.7 - Missing Authorization to Stored Cross-Site Scripting CVSS 7.2 · 20.06.20249.9WishList Member X < 3.26.7 - Authenticated (Subscriber+) Remote Code Execution CVSS 9.9 · 20.06.20248.8WishList Member X < 3.26.7 - Authenticated (Subscriber+) Privilege Escalation CVSS 8.8 · 20.06.20245.3WishList Member X < 3.26.7 - Missing Authorization to Information Disclosure CVSS 5.3 · 20.06.202420.01.20264.3WishList Member X <= 3.29.0 - Missing Authorization CVSS 4.3 · 20.01.202618.03.20268.8Wishlist Member <= 3.29.0 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 8.8 · 18.03.20267.5Wishlist Member <= 3.29.0 - Authenticated (Subscriber+) PHP Object Injection CVSS 7.5 · 18.03.202622.05.20268.8Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action CVSS 8.8 · 22.05.20268.8WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action CVSS 8.8 · 22.05.20268.8Wishlist Member <= 3.32.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action CVSS 8.8 · 22.05.20268.8Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action CVSS 8.8 · 22.05.2026

Strategic Overview

Avg CVSSHigh
7.7/ 10
Patch Coverage80%
Open

3

Fixed

12

Get automatic notifications for all Wishlist Member vulnerabilities before they are exploited.

Vulnerability Records

15 records
2026-05-22 16:24
Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action
Wishlist Member
<= 3.30.1
CVE-2026-6895
8.8
High
h0xiloYes
2026-05-22 16:23
Wishlist Member <= 3.32.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action
Wishlist Member
<= 3.32.0
CVE-2026-6897
8.8
High
h0xiloYes
2026-05-22 16:22
WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action
Wishlist Member
<= 3.30.1
CVE-2026-6898
8.8
High
h0xiloYes
2026-05-22 16:21
Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action
Wishlist Member
<= 3.30.1
CVE-2026-6419
8.8
High
h0xiloYes
2026-03-18 00:00
Wishlist Member <= 3.29.0 - Authenticated (Subscriber+) Arbitrary File Upload
Wishlist Member
<= 3.29.0
CVE-2026-25446
8.8
High
Jarno Vos (jarnovos)No
2026-03-18 00:00
Wishlist Member <= 3.29.0 - Authenticated (Subscriber+) PHP Object Injection
Wishlist Member
<= 3.29.0
CVE-2026-25445
7.5
High
0xd4rk5id3No
2026-01-20 00:00
WishList Member X <= 3.29.0 - Missing Authorization
Wishlist Member
<= 3.29.0
CVE-2026-24575
4.3
Medium
0xd4rk5id3No
2024-06-20 00:00
WishList Member X < 3.26.7 - Unauthenticated Denial of Service
Wishlist Member
< 3.26.7
CVE-2024-37111
5.3
Medium
Dave JongYes
2024-06-20 00:00
WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution
Wishlist Member
< 3.26.7
CVE-2024-37112
10.0
Critical
Dave JongYes
2024-06-20 00:00
WishList Member X < 3.26.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Wishlist Member
< 3.26.7
CVE-2024-37108
8.1
High
Dave JongYes
Showing 1–10 of 15 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C