YITH WooCommerce Wishlist

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ nipinuk

   5mo ago

   Significantly slowed down my website due to automated bots targeting query string “add_to_wishlist” on this plugin. In just the last 24 hours, these bots have generated 5194 PHP requests to that query string. Two ways to avoid this: Generate server-side ReCAPTCHA for all the requests to the mentioned query string. Disable the plugin This topic was modified 3 months, 2 weeks ago by nipinuk.

   Read on wp.org ↗
2. ★★★★★ Jordi Ortega Margarit

   5mo ago

   Em sembla fantastic que un plugin “lliure” funcioni bé a la primera, es una cosa que no sol passar. Estic francament content, encara que de moment no he trobat on puc consultar les llistes de desitjos dels meus clients.

   Read on wp.org ↗
3. ★★★★★ igor2021

   11mo ago

   The plugin generated about a thousand indexable URLs with the query parameter ?add_to_wishlist= (and related _wpnonce, rest-nonce). The plugin was removed a long time ago, but these URLs continue to clutter up the site and receive the “Crawled – currently not indexed” mark in Google Search Console. We do not recommend installing this plugin, as it will only harm your site.

   Read on wp.org ↗
4. ★★★★★ chicho1969

   1.3y ago

   Shortcode, and other options does not work with DIVI theme

   Read on wp.org ↗
5. ★★★★★ oxen130

   1.6y ago

   Very pleased with this plugin. Very easy to use and set up, especially when you follow the included tutorial.

   Read on wp.org ↗
6. ★★★★★ tyd198025

   1.7y ago

   Easy to use, useful plugin!

   Read on wp.org ↗
7. ★★★★★ quintusg

   1.8y ago

   Yith plugins are massively overpriced in my opinion. There are alternative plugins at a much better price. This particular plugin also has no updates of note each year so I see no reason to update it every year. Save yourself $100 a year and find an alternative. I recommend Crocoblock.

   Read on wp.org ↗
8. ★★★★★ jnarvaez

   1.8y ago

   The wishlist counter is not updated if the /wishlist/ link is not entered. Is the premium version necessary for this to work?

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.17.0 New: support for WooCommerce 11.0 Update: YITH plugin framework 4.17.0
2. — Version 4.16.0 New: support for WooCommerce 10.9 Update: YITH plugin framework 4.16.0
3. — Version 4.15.0 New: support for WooCommerce 10.8 Update: YITH plugin framework 4.15.0
4. — Version 4.14.0 New: support for WordPress 7.0 New: support for WooCommerce 10.7 Update: YITH plugin framework 4.14.0
5. — Version 4.13.0 New: support for WooCommerce 10.6 Update: YITH plugin framework 4.13.0
6. — Version 4.12.0 New: support for WooCommerce 10.5 Update: YITH plugin framework 4.12.0

10 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference ↗
   2026-05-07 CVE-2026-27329 Authorization Bypass Through User-Controlled Key Affects <= 4.12.0 Patched in 4.13.0
2. Medium · 5.3 YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Insecure Direct Object Reference to Wishlist Rename ↗
   2026-03-20 CVE-2026-4432 Authorization Bypass Through User-Controlled Key Affects < 4.13.0 Patched in 4.13.0
3. Medium · 5.3 YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion ↗
   2025-11-18 CVE-2025-12777 Improper Authorization Affects <= 4.10.0 Patched in 4.10.1
4. Medium · 5.3 YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename ↗
   2025-11-18 CVE-2025-12427 Authorization Bypass Through User-Controlled Key Affects <= 4.10.0 Patched in 4.10.1
5. Medium · 6.4 YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ↗
   2025-06-13 CVE-2025-5238 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.5.0 Patched in 4.6.0
6. Medium · 4.4 YITH WooCommerce Wishlist <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2024-05-30 CVE-2024-34385 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.32.0 Patched in 3.33.0
7. High · 7.1 YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization ↗
   2022-11-11 Missing Authorization Affects <= 3.14.0 Patched in 3.15.0
8. Medium · 4.3 YITH plugins by YITHEMES <= (Various Versions) - Cross-Site Request Forgery ↗
   2022-11-11 CVE-2022-44630 Cross-Site Request Forgery (CSRF) Affects <= 3.14.0 Patched in 3.15.0
9. Medium · 4.3 YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change ↗
   2019-10-31 CVE-2019-16251 Missing Authorization Affects <= 2.2.13 Patched in 2.2.14
10. Medium · 6.1 YITH WooCommerce Wishlist <= 2.1.2 - SQL Injection ↗
    2018-01-16 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.1.2 Patched in 2.2.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 69 languages, 10 at 90% or more

Plus 45 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-05-08 500K+ → 400K+ down after 200 days in tier
2. 2025-10-20 600K+ → 500K+ down after 186 days in tier
3. 2025-04-17 700K+ → 600K+ down after 140 days in tier
4. 2024-11-28 800K+ → 700K+ down after 2 days in tier
5. 2024-11-26 700K+ → 800K+ up after 31 days in tier
6. 2024-10-26 800K+ → 700K+ down after 117 days in tier
7. 2024-07-01 900K+ → 800K+ down after 273 days in tier
8. 2023-10-02 800K+ → 900K+ up after 3 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Wishlist for WooCommerce 900+ installs · 4.2★ · 2 shared tags A
• Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later 800+ installs · 4.0★ · 2 shared tags B
• Wishlist for WooCommerce 600+ installs · 3.9★ · 2 shared tags C
• Wishlist and Save for later for Woocommerce 80+ installs · 4.0★ · 2 shared tags B
• Productive Commerce – Wishlist, Compare, Quick View, & MiniCart 40+ installs · 3.6★ · 2 shared tags B
• CECOM Wishlist for WooCommerce — installs · 3.6★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for YITH WooCommerce Wishlist into a readme, a review or a deck. It updates itself.

YITH WooCommerce Wishlist: 400K+ active installs, 3.9★ (262 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/yith-woocommerce-wishlist