Vulnerabilities

TI-2026-56425 CVE-2026-81789 · GHSA-2q5g-f96x-5fqw

WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00533 Published 2026-09-10 No fix listed CWE-22

TI-2026-41474 CVE-2026-57649 · GHSA-5p8m-h8vr-j4rc

WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability

LOW 20

Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-06-26 No fix listed CWE-862

TI-2023-28062 CVE-2023-51408 · GHSA-9954-329g-42vc

WordPress WP Optin Wheel Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure

LOW 39

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Opt…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0048 Published 2024-01-08 No fix listed CWE-532

TI-2023-10974 CVE-2023-25698 · GHSA-h8xx-wx5h-hmp8

WordPress Shoppable Images Lite Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00248 Published 2023-05-18 No fix listed CWE-352

Vulnerabilities

Filters

WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability

WordPress WP Optin Wheel Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure

WordPress Shoppable Images Lite Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)