Wishlist
Limited data: Wishlist has under 1,000 active installs and less than 12 weeks of history, so we do not rate it yet.
Capped at 39 while a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 85 |
| Security | 0 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- CriticalSEC-2Vulnerability published 4 Jun 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.18 Jun 2025Evidence
- CriticalSEC-2Vulnerability published 16 May 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.30 May 2025Evidence
- CriticalSEC-2Vulnerability published 16 May 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.30 May 2025Evidence
- InfoSEC-39 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
Commit history is collected for plugins with 1,000+ installs or on a watchlist. No ownership changes recorded since 3 Nov 2026.
Maintenance
- Last release
- 5 months ago
- Releases, 24 months
- 0
- Tested up to
- 7.0 vs 7.1
- Requires PHP
- not stated supported 8.2+
Last release 8 Jun 2026. Tested up to 7.0, 1 major version behind WordPress 7.1. Release history builds as we see new versions.
Support
Support history appears after our first snapshots of the forum counts.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 4 Jun 2025 | Wishlist <= 2.1.0 - Reflected Cross-Site Scripting | 6.1 | <= 2.1.0 | No fix | n/a |
| 30 May 2025 | Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting | 6.4 | <= 1.0.43 | 1.0.44 | n/a |
| 16 May 2025 | Wishlist <= 2.1.0 - Authenticated (Subscriber+) Information Exposure | 4.3 | <= 2.1.0 | No fix | n/a |
| 16 May 2025 | Wishlist <= 2.1.0 - Missing Authorization | 4.3 | <= 2.1.0 | No fix | n/a |
| 9 Apr 2025 | Wishlist <= 1.0.44 - Authenticated (Subscriber+) SQL Injection | 6.5 | <= 1.0.44 | Not affected | n/a |
| 4 Apr 2025 | Wishlist <= 1.0.44 - Cross-Site Request Forgery | 4.3 | <= 1.0.44 | Not affected | n/a |
| 6 Mar 2025 | Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting | 6.4 | <= 1.0.43 | 1.0.44 | n/a |
| 23 Feb 2025 | Wishlist <= 1.0.41 - Authenticated (Contributor+) SQL Injection | 6.5 | <= 1.0.41 | 1.0.42 | n/a |
| 15 Jan 2025 | Wishlist <= 1.0.39 - Reflected Cross-Site Scripting | 6.1 | <= 1.0.39 | 1.0.40 | n/a |
Source: Wordfence Intelligence.
Reputation
Lifetime rating 3.8 from 13 ratings. Quarterly trends appear as new reviews arrive.
| 5 star | 8 |
|---|---|
| 4 star | 1 |
| 3 star | 0 |
| 2 star | 1 |
| 1 star | 3 |
Momentum
300+ active installs. History builds with each weekly snapshot.
Momentum history builds with each snapshot.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
No healthier plugin in the same category yet.
Facts
| Version | 1.0.46 |
|---|---|
| Author | PickPlugins |
| Added | 11 Oct 2017 |
| Last updated | 8 Jun 2026 |
| Active installs | 300+ |
| Requires WordPress | 3.8 |
| Tested up to | 7.0.8 |
| Requires PHP | not stated |
| Category | not stated |
| Tags | Wishlist, wish list, product wishlist, woocommerce wishlist |
Other plugins by this author: Post Grid, Accordions, Breadcrumb - Breadcrumb for WooCommerce and Custom Post Types, Product Slider, Product Grid, Product Masonry, Related Posts By PickPlugins, Social Share Button, Team Showcase, PickPlugins Pricing Table, ComboBlocks - Block Library & Page Builder, PickPlugins Mail Picker - Email Marketing & Newsletters
Questions
Is Wishlist still maintained?
Wishlist was last updated on 8 Jun 2026. Its Canary status is Limited data.
Is Wishlist safe?
Wishlist has 3 published vulnerabilities with no patched version. Its Canary status is Limited data.
Who owns Wishlist?
The wordpress.org author is PickPlugins. We have recorded no ownership change.
What can I use instead of Wishlist?
We have no healthier plugin in the same category on record yet.