---
title: "TI WooCommerce Wishlist"
description: "TI WooCommerce Wishlist in detail: which stores it suits, free version limits, Premium pricing, recommended settings and past vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/ti-woocommerce-wishlist/"
published: "2026-11-05T08:00:00+00:00"
modified: "2026-11-05T21:26:34+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/ti-woocommerce-wishlist/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/ti-woocommerce-wishlist/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/ti-woocommerce-wishlist/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/ti-woocommerce-wishlist/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/ti-woocommerce-wishlist/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/ti-woocommerce-wishlist/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/ti-woocommerce-wishlist/index.md"
---

# TI WooCommerce Wishlist

TI WooCommerce Wishlist adds a wishlist to WooCommerce, for customers and for visitors without an account. Our take on whether the free version is enough for your store, the settings that matter (guests, sharing, My Account) and the vulnerabilities to patch.

## The essentials

- Best for WooCommerce stores selling configurable products or gifts, with shareable lists.
- Main caveat: one list per customer, and no stats or emails without Premium.
- Free; Premium costs $79 a year for one site, or $199 for a lifetime license.

## What TI WooCommerce Wishlist does in your store

TI WooCommerce Wishlist adds a wishlist to a [WooCommerce](https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/) store. An “Add to Wishlist” button goes on the product page and in product listings (Shop page, categories), or wherever you want with the `[ti_wishlists_addtowishlist]` shortcode. The list shows up on a page that holds `[ti_wishlistsview]`, or in the WooCommerce My Account area: a product table with price, stock and date added, checkboxes, bulk actions and buttons to add everything to the cart. A product counter can also appear in a menu.

Visitors without an account get a list too, tied to cookies (`tinv_wishlistkey`, `tinv_wishlist_owner`). By default, a guest list is deleted 30 days after the last product was added. Interactions run over AJAX so they keep working with page caching, and a documented REST API can also read and edit lists.

The developer, TemplateInvaders, publishes the free version on wordpress.org and sells a Premium version. A setup wizard creates the wishlist page on activation; settings then live under the TI Wishlist admin menu, with more than 60 appearance options and a custom CSS field.

![Diagram: TI WooCommerce Wishlist works on visitors and bots, database and files, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/ti-wishlist/diagram-en.svg?v=b658422a)

## Which stores TI WooCommerce Wishlist suits

A wishlist pays off when people decide over several visits or buy for someone else, especially in:

- **Stores with product options** (custom fields, bundles, composite products): the developer maintains more than 50 integrations that keep the chosen configuration in the list.
- **Gift shops**: the list can be shared by link, email, copy to clipboard, Facebook, Twitter, Pinterest or WhatsApp.
- **Sites that want the list inside the customer account**, thanks to the option that moves it under My Account, with no public page.
- **Stores that need multiple lists or email follow-ups**, as long as they upgrade to Premium.

It adds little to a store with a handful of impulse-buy products. If you want to know what your customers are saving, the free version won’t do: product analytics in the admin and promotional emails are Premium-only. Compare with [YITH WooCommerce Wishlist](https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/).

## TI WooCommerce Wishlist strengths and limits

### Strengths

- **Lots of integrations.** Product options, bundles, subscriptions, bookings, caching plugins and themes: the changelog updates them with every release.
- **A list in My Account.** One option puts the list in the WooCommerce customer area and switches off every sharing feature.
- **Guest lists don’t pile up.** They are deleted automatically after an adjustable number of days, 30 by default.
- **A lifetime license is available.** Premium comes as a yearly subscription or a lifetime license, with a 14-day money-back guarantee.

### Limits

- **One list per customer in the free version.** Multiple lists, per-list privacy, quantities, list totals and following other customers’ lists are Premium-only.
- **No store-side analytics.** Product stats for the admin, promotional emails and the estimate request feature require Premium.
- **A record of serious flaws.** Two critical vulnerabilities exploitable without an account were published in 2024 and 2025 (details below).
- **Uneven translations.** The French one, for example, leaves several settings in English and labels the “Enable support chat” box as “Disable support chat”.

## The TI WooCommerce Wishlist settings we recommend

All of these settings are under TI Wishlist > General Settings (version 2.14).

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Wishlist Page**  TI Wishlist > General Settings | The page created by the wizard, which holds `[ti_wishlistsview]` | With no page assigned, the plugin flags an incomplete setup and the list may misbehave. |
| **Require Login**  TI Wishlist > General Settings | On if the list is for customers only, otherwise off (default) | When on, guests must sign in to use the list, so there are no guest lists to keep. |
| **Days after which the guest wishlist will be deleted**  TI Wishlist > General Settings | 30 (default) or less | Match this period to your data retention policy. |
| **Setup wishlist page under WooCommerce My Account section**  TI Wishlist > General Settings | On if your customers don’t share their lists | Off by default. The list moves to My Account and all sharing features are turned off. |
| **Social Networks Sharing Options**  TI Wishlist > General Settings | Only the buttons your customers use | All six buttons are on by default; anyone who gets the link can see what is in the list. |
| **Show stats for each product**  TI Wishlist > General Settings | Off (default), unless it is a marketing choice | When on, the button publicly shows how many times each product was added to wishlists. |
| **Enable support chat**  TI Wishlist > General Settings > Support Chat Settings | Off (default), on only while you need help | According to the developer, the chat collects details about your setup to speed up support. |
| **Erase All Data on Uninstall**  TI Wishlist > General Settings > Plugin Data Settings | Off (default), on only right before a permanent removal | Deleting lists and settings cannot be undone: back up first. |
| **Automatic updates**  Plugins > Installed Plugins | On for TI WooCommerce Wishlist | Several past vulnerabilities could be exploited without an account. |

- In a private window, add a product to the list, reload the page, then clear the cache: the button and counter should match the real state of the list.
- Open a share link in another browser and check that it shows only what you are willing to make visible.
- If you use product options, add a configured product to the list, then to the cart, and check that the options and price carry over.

## TI WooCommerce Wishlist security: critical flaws with no login required

Three vulnerabilities sum up the risks of a plugin open to visitors without an account:

- **August 2024, CVE-2024-43917**: an [SQL injection](https://www.wp-masquerade.com/glossary/sql-injection/) exploitable without an account affected versions up to 2.8.2 (CVSS 9.3). Fixed in 2.9.0.
- **May 2025, CVE-2025-47577**: with no file type check, a visitor without an account could upload an arbitrary file to the server, with a risk of [remote code execution](https://www.wp-masquerade.com/glossary/remote-code-execution/) (CVSS 10). Versions up to 2.9.2, fixed in 2.10.0.
- **October 2026, CVE-2026-15261**: before version 2.13.0, the REST API did not apply the owner-only check, and a visitor without an account could read the contents of private wishlists.

What to do: turn on automatic updates and stay on the latest version, 2.13.0 at the very least. The rest of store security is covered in our WooCommerce security guide, and our [vulnerability alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) flag new flaws. WP Masquerade Pro renames the `ti-woocommerce-wishlist` folder in file addresses and in the IDs of its CSS and JavaScript tags, which makes the plugin harder to spot without replacing the update; the `tinvwl_add_to_wishlist` JavaScript variable and the `tinvwl-*` classes stay visible.

## TI WooCommerce Wishlist FAQ

**Can a visitor without an account keep their list?**

Yes, the list is tied to cookies and kept for 30 days after the last product was added, by default. If they clear their cookies or switch devices, it is lost; once they sign in, the guest list can be carried over to their account.

**Can customers create several wishlists?**

Not with the free version, which handles one list per customer. Multiple lists, each with its own privacy setting, are part of Premium.

**Does TI WooCommerce Wishlist work with page caching?**

Yes, the developer describes it as cache-friendly and maintains integrations with WP Rocket and LiteSpeed Cache, among others. Still, test it in a private window.

**How much does the Premium version cost?**

On the TemplateInvaders site: $79 a year for one site, $99 for 5 sites and $199 for 30 sites, with one year of updates and support. Lifetime licenses cost $199, $249 and $499, and a 14-day money-back guarantee applies.

## Key facts

- Category: E-commerce
- Vendor: TemplateInvaders
- Price: Free; Premium costs $79 a year for one site ($99 for 5 sites, $199 for 30), or a lifetime license from $199
- Active installations (wordpress.org): 100 000+
- Version: 2.14.2
- Official page: https://wordpress.org/plugins/ti-woocommerce-wishlist/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: folder name, tag IDs
- Still visible: JavaScript variables, CSS classes