IPS Order Wishlist

IPS Order Wishlist adds a focused wishlist experience to WooCommerce shops. Customers can save products, review their wishlist in the My Account area, remove items, share wishlist links and continue shopping from saved products.

This WordPress.org package is the standalone free Core edition. It contains no IPS license client, no third-party update checker and no separately distributed Pro runtime. Updates for this package are provided through WordPress.org.

Requirements

• WordPress 6.4 or newer.
• WooCommerce 8.5 or newer.
• PHP 7.4 or newer.
• For security and performance, use the latest stable WordPress and WooCommerce releases with PHP 8.3 or 8.4. PHP 7.4 remains supported for the declared minimum runtime matrix.

Features

• Add products to a wishlist from product and shop contexts.
• View and manage wishlist items in My Account.
• Optional wishlist sharing.
• Core wishlist settings for labels, display and styling.
• Lightweight reports for basic wishlist activity.
• Optional back-in-stock wishlist email.
• Privacy exporter and eraser support for registered-customer wishlist data.

Privacy

The plugin stores wishlist records, saved product references, list names, visibility settings and dates needed to provide the wishlist feature. Logged-in customer data is connected to the WordPress user account.

When guest wishlists are enabled, an HTTP-only ipscmi_order_wishlist_session_<site-hash> cookie contains a random, signed session identifier and expiry data. Its default lifetime is 30 days and can be changed by site code through a WordPress filter. The corresponding database records remain until they expire or are deleted. The cookie is marked secure when the shop is served securely.

The optional back-in-stock email is disabled by default. When a shop manager enables it, its delivery queue can temporarily store the recipient user ID and email address, locale, referenced products and wishlists, and delivery metadata. Acknowledged payloads are cleared. Acknowledged notifications and permanently stale queued or expired-delivery jobs are removed after 30 days in bounded batches of no more than 100 records; active delivery leases are not removed by maintenance.

Email unsubscribe links use hashed, expiring verification challenges in WordPress user metadata. The plugin also stores the time at which a customer unsubscribed so that the preference remains effective. For registered customers, the WordPress personal-data exporter and eraser cover wishlist records, queued notifications and these email preferences. It exports only active and consumed unsubscribe-link counts, not verification-challenge values or hashes. Guest wishlists instead follow their expiry or explicit uninstall cleanup.

Deactivation does not delete plugin data. Uninstall also retains data by default. A shop manager can explicitly enable Delete plugin data on uninstall in the base Wishlist settings before uninstalling; that choice permanently removes wishlist records, queued notifications, email preferences and plugin settings. The currently configured Wishlist page is removed only when the plugin created it. An existing page selected by the shop manager is retained.

If a shop manager configures a custom icon hosted on another domain, visitors’ browsers request that icon from the selected host. The host’s own privacy policy then applies to that request.

The plugin does not send telemetry to IPS, and this WordPress.org package does not contact IPS update or license services.

Source and Build Tools

This package includes the human-readable React source files, package metadata and build configuration needed to reproduce the distributed JavaScript assets. The production assets are built from the included ips-admin-react and ips-react source files. Core frontend integration and styling are implemented in the readable IPS presentation source under includes/classes/Wishlist/Presentation/Frontend/.

Development build overview:

1. Run npm ci --prefix ips-admin-react and npm ci --prefix ips-react.
2. Run npm run build:wordpress-org-assets from the plugin root to build the WordPress.org Core assets.
3. Run the WordPress.org package audit before submitting a release.

The exact third-party components and their licenses are documented in THIRD-PARTY-NOTICES.txt. Complete license texts are included in the package at the paths listed there.

Third-party code

• Bundled JavaScript runtime modules: Axios, Redux Toolkit, React Redux, Redux, Immer, Redux Thunk, use-sync-external-store and nanoid under the MIT License. Exact versions, upstream projects and copyright notices are listed in THIRD-PARTY-NOTICES.txt. React, ReactDOM and the admin API client are supplied by WordPress and are not embedded in the plugin bundles.
• Composer’s generated runtime autoloader is distributed under the MIT License. Its upstream project, copyright notice and bundled license path are listed in THIRD-PARTY-NOTICES.txt.