CVE-2025-47577: critical vulnerability in templateinvaders TI WooCommerce Wishlist
WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 10epss 4.6%
from disclosure to weapon11 days
Published on NVDMay 19
1st PoC+11d
Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
templateinvaders · TI WooCommerce Wishlistpublic PoCs found — 2
githubgithub.com/Yucaerin/CVE-2025-47577★ 4githubgithub.com/sug4r-wr41th/CVE-2025-47577★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — templateinvaders TI WooCommerce Wishlist
In the same product, most dangerous first.
CVE-2020-36725HIGHTI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options UpdateEPSS 1.1%CVE-2025-9207MEDIUMTI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML InjectionEPSS 0.4%CVE-2024-10567HIGHTI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard AccessEPSS 0.4%CVE-2025-58247MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-67929MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-32920MEDIUMWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%