CVE-2024-13774

MEDIUM 6.1

Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'save_to_multiple_wishlist' function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CWE	CWE-352
Vendor	wpcodefactory
Product	wishlist for woocommerce: multi wishlists per customer
Published	Mar 8, 2025
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for wpcodefactory wishlist for woocommerce: multi wishlists per customer

Be the first to know when new medium vulnerabilities affecting wpcodefactory wishlist for woocommerce: multi wishlists per customer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

wpcodefactory / Wishlist for WooCommerce: Multi Wishlists Per Customer

0 ≤ 3.1.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

Tim Coen