Read the docs
TI-2021-07253 Aliases CVE-2021-24974GHSA-x3mr-p889-7f32

Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSS

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.

Why it matters now

EPSS 0.00607 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Product Feed PRO for WooCommerce (Unknown): 11.0.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownProduct Feed PRO for WooCommerce11.0.7 to before 11.0.711.0.7Patch availableCNA
  • Product Feed PRO for WooCommerce VendorUnknown Affected 11.0.7 to before 11.0.7 Fixed in 11.0.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:adtribes:product_feed_pro_for_woocommerce:*:*:*:*:*:wordpress:*:*before 11.0.7VulnerableAdtribes
  • cpe:2.3:a:adtribes:product_feed_pro_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 11.0.7 Vulnerable ·Adtribes

Remediation

  • Fix · CNA Product Feed PRO for WooCommerce (Unknown) Fixed in 11.0.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24974
  2. 2026-10-03 Alias added: GHSA-x3mr-p889-7f32

References

Exploit 1

  • TI-2022-23139 WordPress Product Feed PRO for WooCommerce Plugin <= 12.4.4 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2024-21164 SQL injection in ExportFeed.com Product Feed on WooCommerce for Google CVSS 3.1HIGH 7.6
  • TI-2022-00350 Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences