Product Feed Manager
Monthly
PHP object injection in the WordPress plugin Product Feed Manager (best-woocommerce-feed) 7.14.1 and earlier allows an authenticated WooCommerce shop manager to pass serialized data into plugin code that unserializes it, scored CVSS 7.2 (CWE-502) with high confidentiality, integrity and availability impact. Because the vector is PR:H, only a high-privilege shop manager account can reach the vulnerable path, and the realistic worst case depends on whether a usable POP gadget chain is present in the plugin, WordPress core or another installed component; object injection alone may not yield code execution. No public exploit code is identified in the supplied sources and the issue is not listed as confirmed actively exploited (CISA KEV), so this is a conditional, privilege-gated risk prioritised for remediation this week rather than an internet-wide emergency.
Authenticated SQL injection in the Rextheme Product Feed Manager WordPress plugin (slug best-woocommerce-feed) affects all versions up to and including 7.12.0 and lets an attacker with at least Contributor-level access on the site inject arbitrary SQL through the plugin's query handling. The reported CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), with the assessed vector refining this to AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so the dominant impact is high-confidentiality database disclosure rather than full site takeover. Exploitation requires a low-privileged authenticated account, which makes the risk significantly higher on sites with open registration or broadly granted Contributor/Author roles and much lower on single-admin sites; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
PHP object injection in the WordPress plugin Product Feed Manager (best-woocommerce-feed) 7.14.1 and earlier allows an authenticated WooCommerce shop manager to pass serialized data into plugin code that unserializes it, scored CVSS 7.2 (CWE-502) with high confidentiality, integrity and availability impact. Because the vector is PR:H, only a high-privilege shop manager account can reach the vulnerable path, and the realistic worst case depends on whether a usable POP gadget chain is present in the plugin, WordPress core or another installed component; object injection alone may not yield code execution. No public exploit code is identified in the supplied sources and the issue is not listed as confirmed actively exploited (CISA KEV), so this is a conditional, privilege-gated risk prioritised for remediation this week rather than an internet-wide emergency.
Authenticated SQL injection in the Rextheme Product Feed Manager WordPress plugin (slug best-woocommerce-feed) affects all versions up to and including 7.12.0 and lets an attacker with at least Contributor-level access on the site inject arbitrary SQL through the plugin's query handling. The reported CVSS 3.1 base score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), with the assessed vector refining this to AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so the dominant impact is high-confidentiality database disclosure rather than full site takeover. Exploitation requires a low-privileged authenticated account, which makes the risk significantly higher on sites with open registration or broadly granted Contributor/Author roles and much lower on single-admin sites; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.