Vulnerabilities

TI-2025-42821 CVE-2025-69378 · GHSA-m69x-7wp8-6gjv

WordPress Product Filter for WooCommerce plugin <= 9.1.2 - Privilege Escalation vulnerability

LOW 34

Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product Filter for WooCommerce: from n/a through <= 9.1.2.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00471 Published 2026-02-20 No fix listed CWE-266

TI-2025-42450 CVE-2025-68994 · GHSA-9fvm-rm5j-65fj

WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce:…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0027 Published 2025-12-30 No fix listed CWE-862

TI-2025-42449 CVE-2025-68993 · GHSA-p89v-2q8p-pq5c

WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0027 Published 2025-12-30 No fix listed CWE-862

TI-2024-22212 CVE-2024-33628 · GHSA-94pv-cj6v-mhxr

WordPress XforWooCommerce plugin <= 2.0.2 - Authenticated Local File Inclusion vulnerability

LOW 39

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in XforWooCommerce allows PHP Local File Inclusion.This issue affects XforWooCommerce: from n/a through 2.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0059 Published 2024-06-04 No fix listed CWE-22

TI-2021-03195 CVE-2021-4337 · GHSA-xf7w-7876-xwj4

Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization

MEDIUM 43

Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01274 Published 2023-06-07 Fixed in 1.2.0, 1.3.0 +9 CWE-862