CVE-2024-9156

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	TI WooCommerce Wishlist	<= 2.8.2
templateinvaders	ti_woocommerce_wishlist	<= 2.8.2

References

https://wpscan.com/vulnerability/e95974f9-1f68-4181-89b0-3559d61cfa93/Exploit, Third Party Advisory

Timeline

Published: Oct 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-91577.8** UNSUPPORTED WHEN ASSIGNED ** A privilege escalation vulnerability in CxUIUSvc64.exe and CxUIUSvc32.exe of Synaptics audio drivers allow CVE-2024-91584.6A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject CVE-2024-91596.5An incorrect authorization vulnerability exists in gaizhenbiao/chuanhuchatgpt version git c91dbfc. The vulnerability allows any user to rest CVE-2024-91605.4In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.CVE-2024-91616.5The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data d CVE-2024-91627.2The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validatio CVE-2024-91637.5A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to CVE-2024-91648.8An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and sta CVE-2024-91656.4The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SV CVE-2024-91669.3The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use CVE-2024-91677.8Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacke CVE-2024-91694.8The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and i