Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: themeisle Component: Product Addons & Fields For Woocommerce Clear all filters
TI-2024-23597 CVE-2024-35728 · GHSA-8hv6-7r56-829h

WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability

Priority LOW 24

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Themeisle PPOM for WooCommerce allows Code Inclusion.This issue affects PPOM for WooCommerce: from n/a t…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00331 Published 2024-06-10 No fix listed CWE-74
TI-2024-03696 CVE-2024-3962 · GHSA-3q47-w545-wgfv

Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

Priority MEDIUM 46

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0137 Published 2024-04-26 No fix listed CWE-434
TI-2023-01727 CVE-2023-1839 · GHSA-m9qc-qv5h-cpcj

Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site Scripting

Priority MEDIUM 55

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Script…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00461 Published 2023-05-15 Fixed in 32.0.6