Product Catalog Feed By Pixelyoursite
Monthly
PHP object injection in Product Catalog Feed by PixelYourSite through version 3.1.4 allows an authenticated user with the WordPress/WooCommerce Shop manager role to pass attacker-controlled data into an unsafe deserialization path (CWE-502), potentially causing high confidentiality, integrity, and availability impact if a usable PHP gadget chain is present. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), so the main barrier is the Shop manager privilege rather than network reachability or user interaction. No public exploit was identified at time of analysis, and active exploitation is not confirmed.
PHP object injection in Product Catalog Feed by PixelYourSite through version 3.1.4 allows an authenticated user with the WordPress/WooCommerce Shop manager role to pass attacker-controlled data into an unsafe deserialization path (CWE-502), potentially causing high confidentiality, integrity, and availability impact if a usable PHP gadget chain is present. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), so the main barrier is the Shop manager privilege rather than network reachability or user interaction. No public exploit was identified at time of analysis, and active exploitation is not confirmed.