Husky
Monthly
Broken access control in the Husky Products Filter for WooCommerce plugin (realmag777) at version 1.4.6 and earlier allows remote, unauthenticated attackers to reach functionality that performs no authorization check, resulting in high-impact exposure of confidential data while integrity and availability remain unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows that no credentials or user interaction are required, and the CWE-862 classification confirms the root cause is a missing authorization check rather than a memory-safety or injection defect; the available sources do not identify the specific endpoint, action or feature that lacks the check. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vuln.today priority decision is 'this_week'; no EPSS score was supplied with the intelligence.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.
The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes sensitive data to unauthenticated remote visitors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required to reach the exposure. The impact is rated moderate (CVSS 6.5) with limited confidentiality effect (C:L) and no availability impact, and the available sources do not specify which plugin feature, endpoint, or configuration actually triggers the disclosure or which data is revealed. Neither CISA KEV listing nor public exploit code is present in the supplied intelligence, and no EPSS score was provided, so this is tracked as a this-month remediation item rather than an emergency; exposure is limited to WordPress sites that have this specific plugin installed and active.
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken access control in the Husky Products Filter for WooCommerce plugin (realmag777) at version 1.4.6 and earlier allows remote, unauthenticated attackers to reach functionality that performs no authorization check, resulting in high-impact exposure of confidential data while integrity and availability remain unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows that no credentials or user interaction are required, and the CWE-862 classification confirms the root cause is a missing authorization check rather than a memory-safety or injection defect; the available sources do not identify the specific endpoint, action or feature that lacks the check. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vuln.today priority decision is 'this_week'; no EPSS score was supplied with the intelligence.
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop managers to cause arbitrary local PHP files to be included and executed on every subsequent front-end request, including those made by unauthenticated visitors. The attack is staged: a privileged user (shop manager) poisons a stored plugin setting with a directory traversal sequence, after which the web server silently executes the targeted local file on every page load without further attacker interaction. A publicly available proof-of-concept exists; EPSS is low at 0.50% (40th percentile), suggesting exploitation has not yet reached broad automated scanning, though the POC lowers the bar significantly for targeted attacks against WooCommerce stores.
The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes sensitive data to unauthenticated remote visitors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required to reach the exposure. The impact is rated moderate (CVSS 6.5) with limited confidentiality effect (C:L) and no availability impact, and the available sources do not specify which plugin feature, endpoint, or configuration actually triggers the disclosure or which data is revealed. Neither CISA KEV listing nor public exploit code is present in the supplied intelligence, and no EPSS score was provided, so this is tracked as a this-month remediation item rather than an emergency; exposure is limited to WordPress sites that have this specific plugin installed and active.
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.