Wishsuite Vulnerabilities

The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor...

CVSS:

6.4

Affected:

up to 1.5.1

Fixed in:

1.5.2

Disclosed:

Dec 20, 2025

CVE-2025-13838 on NVD →

The WishSuite plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This...

CVSS:

8.8

Affected:

up to 1.4.4

Fixed in:

1.4.5

Disclosed:

Mar 27, 2025

CVE-2025-30820 on NVD →

The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

6.4

Affected:

up to 1.3.7

Fixed in:

1.3.8

Disclosed:

Mar 25, 2024

CVE-2024-29927 on NVD →

The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web sc...

CVSS:

4.4

Affected:

up to 1.3.4

Fixed in:

1.3.5

Disclosed:

May 18, 2023

CVE-2023-32962 on NVD →

The WishSuite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the plugin_activation() function. This makes it possible for unauthenticated attackers to activate arbitrary plugins, via a forged request grant...

CVSS:

4.3

Affected:

up to 1.3.3

Fixed in:

1.3.4

Disclosed:

Mar 30, 2023

CVE-2023-23731 on NVD →