Is Widilo.co.uk Cashback Reminder safe?

Medium risk

Widilo Cashback Reminder fetches coupon configs from SmartShopping and reports checkout coupon results with a persistent ID.

The extension downloads shop and selector settings from api.smartshopping.ai, then injects a script into shop pages that reads the cart total and tries coupon codes at checkout. After a code is tested, it sends the shop, code, total, discount, and a persistent user UUID to stat.smartshopping.ai.

Widilov5.3.1.37882Firefox Add-ons
51Risk
Who publishes it

Widilo - no other listings under this identity, 10 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Widilo
Website
www.widilo.co.uk

Shared hosts - 10 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

browser-extension-api.widilo.es
Also called by 2 other listings
browser-extension-api.widilo.fr
Also called by 2 other listings, including Widilo
browser-extension-api.widilo.it
Also called by 2 other listings
data-api.widilo.es
Also called by 2 other listings, including Widilo
data-api.widilo.fr
Also called by 2 other listings, including Widilo
data-api.widilo.it
Also called by 2 other listings, including Widilo
api.smartshopping.ai
Also called by 3 other listings, including Budgey
elian.blob.core.windows.net
Also called by 3 other listings, including Budgey
stat.smartshopping.ai
Also called by 3 other listings, including Budgey
widilo.com
Also called by 3 other listings, including Budgey

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SmartShopping coupon engine reports cart totals and codes with a persistent ID

Code analysis shows the coupon engine reads checkout totals and applied codes, then posts the outcome with a persistent random ID to stat.smartshopping.ai.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a checkout page of a shop listed in the remote configuration.

The extension did this

The injected script reads the cart total, tries promo codes and sends the best code and totals to the background script for upload.

The code that does this

Content script forwards each event to the background script

Readable version

Background handler posts event with persistent UUID

background.js
case "smartshopping_log":  const a = await s() || n.DEFAULT_USER_CONFIG;  A({    baseUrls: a.endpoints.stat.base,    endpoint: a.endpoints.stat.logs,    getParams: { sdkVersion: d },    options: {      method: "POST",      headers: { "Content-Type": "application/json;charset=utf-8" },      body: JSON.stringify({        event: e.event,        userUUID: await g(),        clientID: t      })    }  })

UUID generated once and kept in storage.local

background.js
let e = await localstoreGet(["smartshopping_uuid"]);return p(e) ? e = e.smartshopping_uuid : (e = v4(), await localstoreSet({ smartshopping_uuid: e }))
Fields in the POST to stat.smartshopping.ai/logs?sdkVersion=0.7.0
  • User UUID
    3f6c1e2a-8b47-4d0e-9a52-71c4d9e0b6a3 (illustrative)

    Random v4 ID created once and reused on every report.

  • Shop
    shopId from remote config

    Identifier of the shop whose checkout was processed.

  • Promo code
    bestCode value

    The best code found for the cart.

  • Cart total
    total.toFixed(2)

    Checkout total read from the page, two decimals.

  • Discount
    discount.toFixed(2)

    Total minus final cost with the best code.

Hosts contacted by the SmartShopping SDK
    • api.smartshopping.ai

    Serves user config, shop URL lists, default selectors and per-shop configs.

    • stat.smartshopping.ai

    Receives coupon outcome events with the persistent user UUID.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 5.3.1.37882. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Widilo.co.uk Cashback Reminder contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • stat.smartshopping.ai

    Widilo.co.uk Cashback Reminder sends data to stat.smartshopping.ai. 3 other extensions we have analysed send data here.

  • api.smartshopping.ai

    Widilo.co.uk Cashback Reminder sends data to api.smartshopping.ai. One other extension we have analysed sends data here.

Updated 15 October 2026amo-2603305