{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "3.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "pradeep suvarna"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the \u0027filterSettings[default_query]\u0027 parameter of the \u0027filtersFrontend\u0027 AJAX action. The handler is registered as \u0027wp_ajax_nopriv_filtersFrontend\u0027 and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled \u0027default_query\u0027 array is unconditionally array_merge()\u0027d into the WP_Query arguments, overriding the plugin\u0027s safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) \u2014 including their count and rendered listing markup \u2014 and to force unbounded queries that load all products in a single request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T06:44:24.344Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b51837-5925-497f-bdb8-c32f9011830b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/modules/woofilters/controller.php#L864"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3757178%40woo-product-filter\u0026new=3757178%40woo-product-filter"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-05T16:38:45.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T18:19:22.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter for WooCommerce by WBW \u003c= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-11396",
    "datePublished": "2026-10-31T06:44:24.344Z",
    "dateReserved": "2026-06-05T16:23:36.209Z",
    "dateUpdated": "2026-10-31T06:44:24.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88942",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-01T17:34:37.219182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-01T17:44:29.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "3.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "crow"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027wpf_fid\u0027 JSON Parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability persists in versions that received the 3.4.3 patch because absint() was applied only to the getVar() read path, leaving the wpf_fid value read from the JSON-decoded filterSettings payload entirely unsanitized."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T06:44:20.166Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93f80f84-68b1-4c11-8bc8-19b78e253129?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/classes/class-woobewoo-pf-response.php#L82"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L739"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L513"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L363"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L359"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.4/classes/class-woobewoo-pf-frame.php#L391"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/classes/class-woobewoo-pf-response.php#L82"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L739"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L513"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L363"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/modules/woofilters/class-woobewoo-pf-woofilters-controller.php#L359"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.4.3/classes/class-woobewoo-pf-frame.php#L391"
        },
        {
          "url": "https://github.com/wpcodefactory/woo-product-filter"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3757178/woo-product-filter/trunk/classes/class-woobewoo-pf-response.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-10T15:17:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T18:20:44.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter for WooCommerce by WBW \u003c= 3.4.6 - Reflected Cross-Site Scripting via \u0027wpf_fid\u0027 JSON Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-88942",
    "datePublished": "2026-10-31T06:44:20.166Z",
    "dateReserved": "2026-09-10T15:02:23.186Z",
    "dateUpdated": "2026-11-01T17:44:29.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:59:30.279230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:59:36.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "3.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuto Hyakumoto"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u0027wpf_fid\u0027 parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T03:28:46.397Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28e45ffc-ea55-42a4-97ea-4638f640b712?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.3/classes/req.php#L57"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/modules/woofilters/mod.php#L3845"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.7/modules/woofilters/mod.php#L3845"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/classes/req.php#L57"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.7/classes/req.php#L57"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/modules/woofilters/views/woofilters.php#L774"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.7/modules/woofilters/views/woofilters.php#L774"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.3/modules/woofilters/mod.php#L3845"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.3/modules/woofilters/views/woofilters.php#L774"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3686394%40woo-product-filter\u0026new=3686394%40woo-product-filter"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-04T20:16:28.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-08T14:38:17.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter for WooCommerce by WBW \u003c= 3.4.2 - Reflected Cross-Site Scripting via \u0027wpf_fid\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-7804",
    "datePublished": "2026-09-09T03:28:46.397Z",
    "dateReserved": "2026-05-04T20:01:18.788Z",
    "dateUpdated": "2026-09-09T14:59:36.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3138",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T14:10:53.151921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T15:12:19.084Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "3.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Youssef Elouaer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin\u0027s MVC framework dynamically registering unauthenticated AJAX handlers via `wp_ajax_nopriv_` hooks without verifying user capabilities, combined with the base controller\u0027s `__call()` magic method forwarding undefined method calls to the model layer, and the `havePermissions()` method defaulting to `true` when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin\u0027s `wp_wpf_filters` database table via a crafted AJAX request with `action=delete`, permanently destroying all filter configurations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:34:13.999Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/085a4fae-c3f4-45f9-ab30-846c6297d04e?source=cve"
        },
        {
          "url": "https://wordpress.org/plugins/woo-product-filter/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/frame.php#L416"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/frame.php#L280"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/controller.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/table.php#L345"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3487143%40woo-product-filter%2Ftrunk\u0026old=3479545%40woo-product-filter%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-24T17:53:05.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-23T16:11:48.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter for WooCommerce by WBW \u003c= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-3138",
    "datePublished": "2026-03-24T04:27:49.387Z",
    "dateReserved": "2026-02-24T17:37:54.106Z",
    "dateUpdated": "2026-04-08T16:34:13.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8416",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-27T15:35:26.841291Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-27T15:35:36.633Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "2.9.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Mazzolini"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the \u0027filtersDataBackend\u0027 parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:25:09.376Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/mod.php#L2056"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/controller.php#L136"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3370655%40woo-product-filter\u0026new=3370655%40woo-product-filter\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-21T12:30:11.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-24T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter by WBW \u003c= 2.9.7 - Unauthenticated SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-8416",
    "datePublished": "2025-10-25T06:49:24.974Z",
    "dateReserved": "2025-07-31T14:09:37.682Z",
    "dateUpdated": "2026-04-08T17:25:09.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11269",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-27T15:45:02.383078Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-27T15:57:12.856Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lucas Montes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027approveNotice\u0027 action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin\u0027s settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:32:59.075Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03b1d518-0e5d-4c28-af04-52611ad583a8?source=cve"
        },
        {
          "url": "https://github.com/wpcodefactory/woo-product-filter/commit/313f69908cadc31fa9c1e098ff989dc4f75dfdb5"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3382669%40woo-product-filter\u0026new=3382669%40woo-product-filter\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-21T12:30:11.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-10-24T17:28:32.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter by WBW \u003c= 3.0.0 - Missing Authorization to Unauthenticated Settings Update"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11269",
    "datePublished": "2025-10-25T05:31:17.552Z",
    "dateReserved": "2025-10-03T20:10:38.492Z",
    "dateUpdated": "2026-04-08T16:32:59.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-04T13:10:32.779901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-04T13:10:42.749Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "2.7.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all versions up to, and including, 2.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:45:21.311Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/329aae11-a141-4c61-8198-1cd8e4e6bfea?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.7.8/modules/meta/models/meta_values.php#L163"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.7.8/modules/meta/models/meta_values.php#L174"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-13T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-04-03T16:22:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter by WBW \u003c= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-2317",
    "datePublished": "2025-04-04T05:22:43.213Z",
    "dateReserved": "2025-03-14T16:28:11.663Z",
    "dateUpdated": "2026-04-08T16:45:21.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:woobewoo:product_filter:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "product_filter",
            "vendor": "woobewoo",
            "versions": [
              {
                "lessThanOrEqual": "1.4.9",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-4444",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T19:10:43.023872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-16T19:11:36.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Product Filter for WooCommerce by WBW",
          "vendor": "woobewoo",
          "versions": [
            {
              "lessThanOrEqual": "1.4.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Edgar"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:44:55.393Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30b6b0bf-e632-4e83-89ee-a424382534da?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2527958%40woo-product-filter\u0026new=2527958%40woo-product-filter\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2021-05-07T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Product Filter by WooBeWoo \u003c= 1.4.9 - Missing Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2021-4444",
    "datePublished": "2024-10-16T06:43:26.711Z",
    "dateReserved": "2024-10-15T18:22:01.655Z",
    "dateUpdated": "2026-04-08T16:44:55.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}