Read the docs
TI-2023-01727 Aliases CVE-2023-1839GHSA-m9qc-qv5h-cpcj

Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting

Priority MEDIUM 55Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Product Addons & Fields for WooCommerce (Unknown): 32.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownProduct Addons & Fields for WooCommercebefore 32.0.632.0.6Patch availableCNA
  • Product Addons & Fields for WooCommerce VendorUnknown Affected before 32.0.6 Fixed in 32.0.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:themeisle:product_addons_\&_fields_for_woocommerce:*:*:*:*:*:wordpress:*:*before 32.0.6Vulnerablethemeisle
  • cpe:2.3:a:themeisle:product_addons_\&_fields_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions before 32.0.6 Vulnerable ·themeisle

Remediation

  • Fix · CNA Product Addons & Fields for WooCommerce (Unknown) Fixed in 32.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1839
  2. 2026-10-03 Alias added: GHSA-m9qc-qv5h-cpcj

References

Exploit 1

  • TI-2023-02115 Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2024-03696 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file CVSS 3.1CRITICAL 9.8
  • TI-2024-23597 WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences