HTML Injection Vulnerability in TI WooCommerce Wishlist Plugin for WordPress

CVE-2025-9207

What is CVE-2025-9207?

The TI WooCommerce Wishlist plugin for WordPress allows unauthenticated attackers to exploit an HTML Injection vulnerability present in all versions up to and including 2.10.0. This issue arises from the plugin's failure to properly validate and sanitize input from hidden fields, enabling malicious users to inject arbitrary HTML code into wishlist items. As a result, potential security risks such as cross-site scripting (XSS) can occur, compromising the integrity of the application and the safety of its users.

References