Husky
Monthly
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.