Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization
Priority MEDIUM 43CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01274 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Package Quantity Discount (XforWooCommerce): 1.2.0Price Commander for WooCommerce (XforWooCommerce): 1.3.0+14 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XforWooCommerce | Package Quantity Discount | before 1.2.0 | 1.2.0 | Patch available | CNA |
| XforWooCommerce | Price Commander for WooCommerce | before 1.3.0 | 1.3.0 | Patch available | CNA |
| XforWooCommerce | Bulk Add to Cart for WooCommerce | before 1.3.0 | 1.3.0 | Patch available | CNA |
| XforWooCommerce | Floating Cart for WooCommerce | before 1.3.0 | 1.3.0 | Patch available | CNA |
| XforWooCommerce | Comment and Review Spam Control for WooCommerce | before 1.5.0 | 1.5.0 | Patch available | CNA |
| XforWooCommerce | Add Product Tabs for WooCommerce | before 1.5.0 | 1.5.0 | Patch available | CNA |
| XforWooCommerce | Autopilot SEO for WooCommerce | before 1.6.0 | 1.6.0 | Patch available | CNA |
| XforWooCommerce | XforWooCommerce | before 1.7.0 | 1.7.0 | Patch available | CNA |
| XforWooCommerce | Product Loops for WooCommerce | before 1.7.0 | 1.7.0 | Patch available | CNA |
| XforWooCommerce | Live Search for WooCommerce | before 2.1.0 | 2.1.0 | Patch available | CNA |
| XforWooCommerce | Share, Print and PDF Products for WooCommerce | before 2.8.0 | 2.8.0 | Patch available | CNA |
| XforWooCommerce | Improved Sale Badges for WooCommerce | before 4.4.0 | 4.4.0 | Patch available | CNA |
| XforWooCommerce | Live Product Editor for WooCommerce | before 4.7.0 | 4.7.0 | Patch available | CNA |
| XforWooCommerce | Warranties and Returns for WooCommerce | before 5.3.0 | 5.3.0 | Patch available | CNA |
| XforWooCommerce | Improved Product Options for WooCommerce | before 5.3.0 | 5.3.0 | Patch available | CNA |
| XforWooCommerce | Product Filter for WooCommerce | before 8.2.0 | 8.2.0 | Patch available | CNA |
- Package Quantity Discount VendorXforWooCommerce Affected before 1.2.0 Fixed in 1.2.0 Patch available CNA
- Price Commander for WooCommerce VendorXforWooCommerce Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
- Bulk Add to Cart for WooCommerce VendorXforWooCommerce Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
- Floating Cart for WooCommerce VendorXforWooCommerce Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
- Comment and Review Spam Control for WooCommerce VendorXforWooCommerce Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
- Add Product Tabs for WooCommerce VendorXforWooCommerce Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
- Autopilot SEO for WooCommerce VendorXforWooCommerce Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA
- XforWooCommerce VendorXforWooCommerce Affected before 1.7.0 Fixed in 1.7.0 Patch available CNA
- Product Loops for WooCommerce VendorXforWooCommerce Affected before 1.7.0 Fixed in 1.7.0 Patch available CNA
- Live Search for WooCommerce VendorXforWooCommerce Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA
- Share, Print and PDF Products for WooCommerce VendorXforWooCommerce Affected before 2.8.0 Fixed in 2.8.0 Patch available CNA
- Improved Sale Badges for WooCommerce VendorXforWooCommerce Affected before 4.4.0 Fixed in 4.4.0 Patch available CNA
- Live Product Editor for WooCommerce VendorXforWooCommerce Affected before 4.7.0 Fixed in 4.7.0 Patch available CNA
- Warranties and Returns for WooCommerce VendorXforWooCommerce Affected before 5.3.0 Fixed in 5.3.0 Patch available CNA
- Improved Product Options for WooCommerce VendorXforWooCommerce Affected before 5.3.0 Fixed in 5.3.0 Patch available CNA
- Product Filter for WooCommerce VendorXforWooCommerce Affected before 8.2.0 Fixed in 8.2.0 Patch available CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xforwoocommerce:add_product_tabs:*:*:*:*:*:wordpress:*:* | before 1.5.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:autopilot_seo:*:*:*:*:*:wordpress:*:* | before 1.6.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:bulk_add_to_cart:*:*:*:*:*:wordpress:*:* | before 1.3.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control:*:*:*:*:*:wordpress:*:* | before 1.5.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:floating_cart:*:*:*:*:*:wordpress:*:* | before 1.3.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:improved_product_options:*:*:*:*:*:wordpress:*:* | before 5.3.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:improved_sale_badges:*:*:*:*:*:wordpress:*:* | before 4.4.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:live_product_editor:*:*:*:*:*:wordpress:*:* | before 4.7.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:live_search:*:*:*:*:*:wordpress:*:* | before 2.1.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:package_quantity:*:*:*:*:*:wordpress:*:* | before 1.2.0 | Vulnerable | XforWooCommerce |
- cpe:2.3:a:xforwoocommerce:add_product_tabs:*:*:*:*:*:wordpress:*:* Versions before 1.5.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:autopilot_seo:*:*:*:*:*:wordpress:*:* Versions before 1.6.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:bulk_add_to_cart:*:*:*:*:*:wordpress:*:* Versions before 1.3.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:comment_and_review_spam_control:*:*:*:*:*:wordpress:*:* Versions before 1.5.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:floating_cart:*:*:*:*:*:wordpress:*:* Versions before 1.3.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:improved_product_options:*:*:*:*:*:wordpress:*:* Versions before 5.3.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:improved_sale_badges:*:*:*:*:*:wordpress:*:* Versions before 4.4.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:live_product_editor:*:*:*:*:*:wordpress:*:* Versions before 4.7.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:live_search:*:*:*:*:*:wordpress:*:* Versions before 2.1.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:package_quantity:*:*:*:*:*:wordpress:*:* Versions before 1.2.0 Vulnerable ·XforWooCommerce
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xforwoocommerce:price_commander:*:*:*:*:*:wordpress:*:* | before 1.3.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:product_filter:*:*:*:*:*:wordpress:*:* | before 8.2.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:product_loops:*:*:*:*:*:wordpress:*:* | before 1.7.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:share\,_print_and_pdf_products:*:*:*:*:*:wordpress:*:* | before 2.8.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:warranties_and_returns:*:*:*:*:*:wordpress:*:* | before 5.3.0 | Vulnerable | XforWooCommerce |
| cpe:2.3:a:xforwoocommerce:xforwoocommerce:*:*:*:*:*:wordpress:*:* | before 1.7.0 | Vulnerable | XforWooCommerce |
- cpe:2.3:a:xforwoocommerce:price_commander:*:*:*:*:*:wordpress:*:* Versions before 1.3.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:product_filter:*:*:*:*:*:wordpress:*:* Versions before 8.2.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:product_loops:*:*:*:*:*:wordpress:*:* Versions before 1.7.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:share\,_print_and_pdf_products:*:*:*:*:*:wordpress:*:* Versions before 2.8.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:warranties_and_returns:*:*:*:*:*:wordpress:*:* Versions before 5.3.0 Vulnerable ·XforWooCommerce
- cpe:2.3:a:xforwoocommerce:xforwoocommerce:*:*:*:*:*:wordpress:*:* Versions before 1.7.0 Vulnerable ·XforWooCommerce
Remediation
- Fix · CNA Package Quantity Discount (XforWooCommerce) Fixed in 1.2.0
- Fix · CNA Price Commander for WooCommerce (XforWooCommerce) Fixed in 1.3.0
- Fix · CNA Bulk Add to Cart for WooCommerce (XforWooCommerce) Fixed in 1.3.0
- Fix · CNA Floating Cart for WooCommerce (XforWooCommerce) Fixed in 1.3.0
- Fix · CNA Comment and Review Spam Control for WooCommerce (XforWooCommerce) Fixed in 1.5.0
- Fix · CNA Add Product Tabs for WooCommerce (XforWooCommerce) Fixed in 1.5.0
- Fix · CNA Autopilot SEO for WooCommerce (XforWooCommerce) Fixed in 1.6.0
- Fix · CNA XforWooCommerce (XforWooCommerce) Fixed in 1.7.0
- Fix · CNA Product Loops for WooCommerce (XforWooCommerce) Fixed in 1.7.0
- Fix · CNA Live Search for WooCommerce (XforWooCommerce) Fixed in 2.1.0
- Fix · CNA Share, Print and PDF Products for WooCommerce (XforWooCommerce) Fixed in 2.8.0
- Fix · CNA Improved Sale Badges for WooCommerce (XforWooCommerce) Fixed in 4.4.0
- Fix · CNA Live Product Editor for WooCommerce (XforWooCommerce) Fixed in 4.7.0
- Fix · CNA Warranties and Returns for WooCommerce (XforWooCommerce) Fixed in 5.3.0
- Fix · CNA Improved Product Options for WooCommerce (XforWooCommerce) Fixed in 5.3.0
- Fix · CNA Product Filter for WooCommerce (XforWooCommerce) Fixed in 8.2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-4337
- 2026-10-03 Alias added: GHSA-xf7w-7876-xwj4
References
Sources
- CVE-2021-4337 · CVE Program
- CVE-2021-4337 · NVD
- FIRST EPSS
- GHSA-xf7w-7876-xwj4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences