Filtered by vendor Pluginus Subscriptions
Total 85 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-4943 1 Pluginus 1 Bear - Woocommerce Bulk Editor And Products Manager Professional 2026-04-08 4.3 Medium
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
CVE-2023-4942 1 Pluginus 1 Bear - Woocommerce Bulk Editor And Products Manager Professional 2026-04-08 4.3 Medium
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2023-4940 1 Pluginus 1 Bear - Woocommerce Bulk Editor And Products Manager Professional 2026-04-08 4.3 Medium
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-8624 1 Pluginus 1 Wordpress Meta Data And Taxonomies Filter 2026-04-08 9.9 Critical
The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode in all versions up to, and including, 1.3.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2024-11002 1 Pluginus 1 Inpost Gallery 2026-04-08 6.3 Medium
The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVE-2024-10168 1 Pluginus 1 Woot 2026-04-08 6.4 Medium
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woot_button shortcode in all versions up to, and including, 1.0.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2021-24566 1 Pluginus 1 Fox - Currency Switcher Professional For Woocommerce 2025-06-11 8.8 High
The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode.
CVE-2022-4063 1 Pluginus 1 Inpost Gallery 2025-04-17 9.8 Critical
The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.
CVE-2024-34434 1 Pluginus 1 Wordpress Meta Data And Taxonomies Filter 2025-04-10 6.5 Medium
Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2.
CVE-2022-4431 1 Pluginus 1 Fox - Currency Switcher Professional For Woocommerce 2025-04-05 5.4 Medium
The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-4489 1 Pluginus 1 Husky - Products Filter Professional For Woocommerce 2025-03-25 7.2 High
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
CVE-2024-32680 1 Pluginus 1 Husky - Products Filter Professional For Woocommerce 2025-03-20 8.8 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.
CVE-2024-43121 2 Pluginus, Realmag777 2 Husky - Products Filter Professional For Woocommerce, Husky 2025-03-12 9.1 Critical
Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.
CVE-2024-32818 1 Pluginus 1 Wordpress Meta Data And Taxonomies Filter 2025-02-26 4.3 Medium
Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
CVE-2023-28666 1 Pluginus 1 Inpost Gallery 2025-02-26 5.4 Medium
The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
CVE-2023-28664 1 Pluginus 1 Wordpress Meta Data And Taxonomies Filter 2025-02-26 5.4 Medium
The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.
CVE-2024-35730 1 Pluginus 1 Woot 2024-11-21 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in realmag777 Active Products Tables for WooCommerce allows Reflected XSS.This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.3.
CVE-2023-44990 1 Pluginus 1 Wolf - Wordpress Posts Bulk Editor And Products Manager Professional 2024-11-21 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.
CVE-2023-34028 1 Pluginus 1 Wolf - Wordpress Posts Bulk Editor And Manager Professional 2024-11-21 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions.
CVE-2023-31218 1 Pluginus 1 Wolf - Wordpress Posts Bulk Editor And Products Manager Professional 2024-11-21 7.1 High
Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.6 versions.