plugin

Aco Wishlist For Woocommerce Vulnerabilities

2 known security issues reported for the Aco Wishlist For Woocommerce WordPress plugin. Most recent disclosed Nov 12, 2025.

1 medium

Running Aco Wishlist For Woocommerce on your site? Check whether your installed version is affected.

Scan your site free

Wishlist and Save for later for Woocommerce [aco-wishlist-for-woocommerce] < 1.1.23

unknown

[en] The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated att...

Affected:
up to 1.1.23
Fixed in:
1.1.23
Disclosed:
Nov 12, 2025

CVE-2025-12087 on NVD →

Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion

medium

The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attacker...

CVSS:
4.3
Affected:
up to 1.1.22
Fixed in:
1.1.23
Disclosed:
Nov 11, 2025

CVE-2025-12087 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database