{ "title": "YITH WooCommerce Wishlist", "seo_title": "YITH WooCommerce Wishlist: review, settings and limits", "h1": "YITH WooCommerce Wishlist", "description": "YITH WooCommerce Wishlist in detail: which stores it suits, free version limits, Premium pricing, recommended settings and recent security flaws.", "lead": "YITH WooCommerce Wishlist adds a wishlist to WooCommerce, for logged-in customers and guests alike. Our take on whether the free version is enough for your store, the settings that matter (caching, sharing, wishlist page) and the recent flaws you need patched.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:35:03+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "YITH WooCommerce Wishlist", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/yith-woocommerce-wishlist/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "YITH WooCommerce Wishlist", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/yith-woocommerce-wishlist/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "YITH WooCommerce Wishlist", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/yith-woocommerce-wishlist/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "YITH WooCommerce Wishlist", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/yith-woocommerce-wishlist/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "YITH WooCommerce Wishlist", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/yith-woocommerce-wishlist/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "YITH WooCommerce Wishlist", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/yith-woocommerce-wishlist/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "YITH WooCommerce Wishlist", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/yith-woocommerce-wishlist/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/yith-woocommerce-wishlist/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/yith-woocommerce-wishlist/index.json" } ], "headings": [ { "level": 1, "text": "YITH WooCommerce Wishlist" }, { "level": 2, "text": "What YITH WooCommerce Wishlist does in your store" }, { "level": 2, "text": "Which stores get real value from YITH WooCommerce Wishlist" }, { "level": 2, "text": "Strengths and limits of YITH WooCommerce Wishlist" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limits" }, { "level": 2, "text": "The wishlist settings we recommend" }, { "level": 2, "text": "YITH WooCommerce Wishlist security: poorly isolated lists" }, { "level": 2, "text": "YITH WooCommerce Wishlist FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for WooCommerce stores where people buy over several visits or shop for gifts.\n- Main caveat: one list per customer and no store-side view of lists without Premium.\n- Free; Premium costs $99.99 a year for multiple lists, popular products and emails.\n\n## What YITH WooCommerce Wishlist does in your store\n\nYITH WooCommerce Wishlist adds a wishlist to a [WooCommerce](https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/) store and does not work without it. An “Add to wishlist” button appears on the product page and, if you turn it on, in product lists (Shop page, categories, shortcodes). Customers find their products on a dedicated page holding the `[yith_wcwl_wishlist]` shortcode, laid out as a table: chosen variation, price, stock and an add-to-cart button. They can share the list by link, by email or on Facebook, X, Pinterest and WhatsApp.\n\nVisitors without an account get a list too: it is tied to a `yith_wcwl_session_*` session cookie that lasts 30 days by default, and a daily scheduled task deletes expired lists. Lists of logged-in customers are kept with no expiry date. The plugin registers its data with the WordPress personal data export and erase tools and suggests text for your privacy policy.\n\nItalian developer YITH (Your Inspiration Solutions) publishes the free version on wordpress.org and sells a Premium version. Settings live under the YITH > Wishlist menu in the admin.\n\n![Diagram: YITH WooCommerce Wishlist works on visitors and bots, database and files, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible); cookies (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/yith-wishlist/diagram-en.svg?v=ff25208c)\n\n## Which stores get real value from YITH WooCommerce Wishlist\n\nA wishlist pays off mostly when buying takes several visits or the purchase is for someone else:\n\n- **Fashion, home decor, gear**: shoppers compare variations (size, color) and come back to buy later.\n- **Gift stores**: a list shared by link works as a birthday or holiday list for friends and family.\n- **Large catalogs** where visitors set products aside while browsing, with or without an account.\n- **Stores that want to follow up by email** on wishlisted products, though that takes the Premium version.\n\nIt adds little to a store with a handful of impulse-buy products, or to a site selling a single service or subscription. If you want to use your customers’ lists (who saved what, most-added products, promotional emails), the free version won’t do: those features are Premium only.\n\n## Strengths and limits of YITH WooCommerce Wishlist\n\n### Strengths\n\n- **Up and running in minutes.** One page with a shortcode, a button placed automatically, and the list works for logged-in customers and guests alike.\n- **Works with page caching.** The AJAX loading option fetches wishlist items after the cached page is displayed.\n- **Built-in sharing.** Link, email and four social networks, each one toggled separately.\n- **An editable page template.** You can override `wishlist.php` from your theme’s `woocommerce` folder, and the developer lists support for Gutenberg and Elementor.\n\n### Limits\n\n- **One list per customer in the free version.** Multiple lists, public, private or shared visibility and moving items between lists are Premium only.\n- **No store-side view of the lists.** Browsing customer lists, seeing the most-added products and sending promotional emails all require Premium.\n- **No setting to restrict lists to logged-in customers.** That option is part of Premium; the free version opens the wishlist to every visitor.\n- **Recurring access-control bugs.** Four flaws in list ownership checks were published between November 2025 and September 2026 (details below).\n- **Uneven translations.** The developer only guarantees English, Italian and Spanish; other languages rely on volunteer translations that are incomplete.\n\n## The wishlist settings we recommend\n\nPaths start from the YITH > Wishlist menu (version 4.20). Test each change in a private window, ideally on a staging copy of the store.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Wishlist page** Settings > Wishlist page | A dedicated page containing `[yith_wcwl_wishlist]` | Without a valid page, the “View wishlist” link goes nowhere. If you get a 404, save your permalinks again. |\n| **Enable AJAX loading** Settings > General | On if you use page caching | Off by default. Without it, a cached page can show a frozen button that doesn’t match the visitor’s list. |\n| **Share wishlist** Settings > Wishlist page | On only if your customers actually use it | On by default. Anyone who gets the link can see what is in the list. |\n| **Share on social media** (Facebook, X, Pinterest, email, WhatsApp) Settings > Wishlist page | Only the channels your customers use | All on by default; fewer buttons make a lighter, clearer page. |\n| **Product price** (wishlist table column) Settings > Wishlist page | Off if your store hides prices | In catalog mode, the list would otherwise show prices you hide everywhere else. |\n| **Remove items when added to the cart** Settings > Wishlist page | On (default) | The list only keeps products not bought yet. |\n| **Automatic updates** Plugins > Installed Plugins | On for YITH WooCommerce Wishlist | Recent fixes cover flaws that could be exploited without an account. |\n\n- In a private window, add a product to the list, reload the page, then purge the cache: the button should reflect the actual state of your list.\n- Open a share link in another browser and check it only shows what you are happy to make visible.\n- Under Tools > Export Personal Data, run a test export for a customer and check that their wishlist is included.\n- Add the text the plugin suggests to your privacy policy (wishlist cookie, staff access to lists).\n\n## YITH WooCommerce Wishlist security: poorly isolated lists\n\nThe plugin’s recent flaws mostly hit the ownership checks on lists, an [IDOR](https://www.wp-masquerade.com/glossary/idor/) type of bug. The impact stays limited to wishlists, with no site takeover, but several could be exploited without an account:\n\n- **November 2025, CVE-2025-12777 and CVE-2025-12427**: up to version 4.10.0, a visitor with no account could get any customer’s wishlist token through the REST API, then delete items from the list or rename it. Fixed in 4.10.1.\n- **April and September 2026, CVE-2026-4432 then CVE-2026-82305**: two more ways to rename another customer’s list without an account, fixed in 4.13.0 and then 4.18.1.\n- **October 2026, CVE-2026-112199**: a stored [XSS](https://www.wp-masquerade.com/glossary/xss/) flaw published by Patchstack, exploitable with a low-level account, up to version 4.18.1.\n\nWhat to do: turn on automatic updates and stay on the latest version, 4.19.1 at minimum, which also hardens its XSS protection. The rest of store security is covered in our WooCommerce security guide, and our [vulnerability alerts](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) flag new flaws. WP Masquerade Pro renames the plugin folder and its script IDs, which makes the plugin harder for bots to spot without replacing updates; the `yithWcwl` JavaScript variable, the `yith-wcwl-*` classes and the session cookie stay visible.\n\n## YITH WooCommerce Wishlist FAQ\n\n**Can a guest keep their wishlist?**\n\nYes, through a cookie that lasts 30 days by default and gets extended when the visitor comes back. If they clear cookies or switch devices, the list is gone; only logged-in customers keep it indefinitely.\n\n**Can I see what customers put on their lists?**\n\nNot with the free version. Viewing logged-in customers’ lists and the list of most-added products are part of the Premium version.\n\n**How do I move the “Add to wishlist” button?**\n\nIn the Add to wishlist tab, pick another position on the product page and in product lists, or choose the shortcode option and place `[yith_wcwl_add_to_wishlist]` wherever you want.\n\n**How much does the Premium version cost?**\n\n$99.99 a year on the YITH website, with one year of updates and support (EU buyers pay tax on top). The license renews automatically every year unless you cancel the subscription before the due date.\n\n## Key facts\n\n- Category: E-commerce\n- Vendor: YITH\n- Price: Free; Premium version costs $99.99 per year (excluding tax), with one year of updates and support\n- Active installations (wordpress.org): 400 000+\n- Version: 4.20.0\n- Official page: https://wordpress.org/plugins/yith-woocommerce-wishlist/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes, cookies", "catalog": "yith-wishlist", "essentials": [ "Best for WooCommerce stores where people buy over several visits or shop for gifts.", "Main caveat: one list per customer and no store-side view of lists without Premium.", "Free; Premium costs $99.99 a year for multiple lists, popular products and emails." ], "format": "application/json" }