Wishlist Member

Wishlist Member has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 16 are fixed as of September 2026. Their average CVSS score is 7.8, and the most serious one scores 10.0 out of 10. Severity breakdown: 3 critical and 9 high. 2026 was the busiest year with 8 disclosures.

The most common weakness is Improper Privilege Management, behind 4 of the records (25%). Other recurring categories include Missing Authorization, Code Injection.

Every one of the 16 issues recorded for Wishlist Member has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (8) reported by Dave Jong.

Strategic Overview

Avg CVSSHigh

7.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Wishlist Member vulnerabilities before they are exploited.

Highest severity on recordCVSS 10.0CVE-2024-37112

WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution

Read the full analysis

Vulnerability Records

16 records


2026-08-13 17:19	Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter Wishlist Member <= 3.34.1	`CVE-2026-12949`	9.8 Critical	bashu	Yes
2026-05-22 16:24	Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action Wishlist Member <= 3.30.1	`CVE-2026-6895`	8.8 High	h0xilo	Yes
2026-05-22 16:23	Wishlist Member <= 3.32.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action Wishlist Member <= 3.32.0	`CVE-2026-6897`	8.8 High	h0xilo	Yes
2026-05-22 16:22	WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action Wishlist Member <= 3.30.1	`CVE-2026-6898`	8.8 High	h0xilo	Yes
2026-05-22 16:21	Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action Wishlist Member <= 3.30.1	`CVE-2026-6419`	8.8 High	h0xilo	Yes
2026-03-18 00:00	Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) Arbitrary File Upload Wishlist Member <= 3.32.0	`CVE-2026-25446`	8.8 High	Jarno Vos (jarnovos)	Yes
2026-03-18 00:00	Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) PHP Object Injection Wishlist Member <= 3.32.0	`CVE-2026-25445`	7.5 High	0xd4rk5id3	Yes
2026-01-20 00:00	WishList Member X <= 3.32.0 - Missing Authorization Wishlist Member <= 3.32.0	`CVE-2026-24575`	4.3 Medium	0xd4rk5id3	Yes
2024-06-20 00:00	WishList Member X < 3.26.7 - Unauthenticated Denial of Service Wishlist Member < 3.26.7	`CVE-2024-37111`	5.3 Medium	Dave Jong	Yes
2024-06-20 00:00	WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution Wishlist Member < 3.26.7	`CVE-2024-37112`	10.0 Critical	Dave Jong	Yes

Showing 1–10 of 16 reports