Realmag777
Monthly
Broken access control in the Husky Products Filter for WooCommerce plugin (realmag777) at version 1.4.6 and earlier allows remote, unauthenticated attackers to reach functionality that performs no authorization check, resulting in high-impact exposure of confidential data while integrity and availability remain unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows that no credentials or user interaction are required, and the CWE-862 classification confirms the root cause is a missing authorization check rather than a memory-safety or injection defect; the available sources do not identify the specific endpoint, action or feature that lacks the check. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vuln.today priority decision is 'this_week'; no EPSS score was supplied with the intelligence.
Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.
Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The `filter_data[comment_count]` parameter is split on a colon delimiter and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()` sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis.
DOM-based cross-site scripting affects the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (slug profit-products-tables-for-woocommerce) in all versions through 1.1.0, letting a remote attacker deliver crafted input that is unsafely written into the DOM and executed as script in a victim's browser. Because the CVSS scope is changed (S:C) and no authentication is required (PR:N), successful exploitation can affect resources beyond the vulnerable component, though it requires the victim to interact with an attacker-influenced page or link (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Reflected/stored cross-site scripting in the WordPress plugin BEAR (realmag777's WooCommerce Bulk Editor and Products Manager, woo-bulk-editor) version 1.1.8 and earlier allows an unauthenticated remote attacker to inject malicious script that executes in a victim's browser when the victim is lured to interact with a crafted request. The CVSS:3.1 vector (AV:N/PR:N/UI:R/S:C) indicates network-reachable, no-authentication exploitation that requires user interaction and crosses a security scope boundary. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Patchstack.
Unauthenticated SQL injection in the InPost Gallery WordPress plugin (versions 2.1.4.6 and earlier) by realmag777 allows remote attackers to inject arbitrary SQL queries without any authentication. The flaw carries a CVSS 9.3 with a scope change, meaning successful exploitation can extract sensitive database contents and impact resources beyond the vulnerable component. No public exploit identified at time of analysis, but the unauthenticated nature and the visibility of Patchstack-reported WordPress flaws make opportunistic scanning likely.
Authenticated attackers with Contributor-level access can delete entire multi-currency configurations in FOX Currency Switcher Professional for WooCommerce by visiting any wp-admin page with a specific parameter, and the lack of nonce verification allows CSRF-based exploitation against administrators. Confirmed actively exploited (CISA KEV). CVSS 8.1 reflects high integrity and availability impact, with EPSS data unavailable. WordPress plugin affects versions ≤1.4.5, with patch released in version 1.4.6 per Wordfence advisory. The dual attack vectors (direct authenticated abuse and CSRF) significantly increase real-world risk for WooCommerce installations using this currency management plugin.
Blind SQL injection in BEAR woo-bulk-editor plugin for WordPress up to version 1.1.7.1 allows high-privilege authenticated administrators to extract database contents through specially crafted SQL queries. The scope change in CVSS (S:C) indicates potential impact beyond the plugin itself, enabling access to other WordPress data or resources. No public exploit code or active exploitation indicators identified at time of analysis, but Patchstack public disclosure increases weaponization risk.
Blind SQL injection in FOX WooCommerce Currency Switcher plugin (versions ≤1.4.5) allows authenticated high-privilege users to extract database contents via crafted SQL commands. Attacker requires high-privilege access (PR:H) but can breach scope boundaries (S:C), achieving high confidentiality impact and limited availability disruption. No public exploit identified at time of analysis. Affects WordPress installations using the vulnerable plugin for multi-currency e-commerce functionality.
SQL injection vulnerability in the RealMag777 WOLF bulk-editor WordPress plugin (versions up to 1.0.8.7) that allows authenticated administrators to execute blind SQL injection attacks. With a low EPSS score of 0.02% and no KEV listing, this vulnerability requires high privileges to exploit and is not currently being actively exploited in the wild.
The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes sensitive data to unauthenticated remote visitors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required to reach the exposure. The impact is rated moderate (CVSS 6.5) with limited confidentiality effect (C:L) and no availability impact, and the available sources do not specify which plugin feature, endpoint, or configuration actually triggers the disclosure or which data is revealed. Neither CISA KEV listing nor public exploit code is present in the supplied intelligence, and no EPSS score was provided, so this is tracked as a this-month remediation item rather than an emergency; exposure is limited to WordPress sites that have this specific plugin installed and active.
Sensitive information exposure in HUSKY - Products Filter for WooCommerce Professional through 1.4.5 allows unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on public frontend filter pages when the Statistics extension, saved external MySQL credentials, and Turbo Mode are all enabled. This is a moderate, conditional risk: default or internal-database configurations are not affected, and no public exploit was identified at time of analysis, but any site that has adopted those documented settings should treat the credentials as potentially exposed.
Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis.
Authorization bypass in FOX - Currency Switcher Professional for WooCommerce (all versions through 1.4.6) allows authenticated attackers with Subscriber-level access to impersonate higher-privileged roles - such as wholesale customers or administrators - to obtain discounted or otherwise role-restricted product pricing. The flaw stems from the plugin's fixed user-role pricing engine blindly trusting a client-supplied HTTP request parameter over the server-side session object when resolving a user's role for price calculation. No public exploit is identified at time of analysis, and real-world impact is bounded by a non-default configuration requirement, keeping the CVSS base score at 4.3.
Cross-Site Request Forgery in BEAR - Bulk Editor and Products Manager Professional for WooCommerce (all versions up to 1.1.5) allows unauthenticated attackers to modify WooCommerce product data including prices, descriptions, and other fields by tricking administrators or shop managers into clicking a malicious link, due to missing nonce validation in the woobe_redraw_table_row() function. CVSS 6.5 reflects the high integrity impact; no public exploit code or active exploitation has been confirmed at analysis time.
Cross-Site Request Forgery in BEAR - Bulk Editor and Products Manager Professional for WooCommerce (all versions up to 1.1.5) allows unauthenticated attackers to delete WooCommerce taxonomy terms via a malicious link that tricks site administrators or shop managers into performing an action. The vulnerability stems from missing nonce validation on the woobe_delete_tax_term() function, enabling integrity compromise with low CVSS impact (4.3) but requiring user interaction.
Missing authorization in RealMag777 FOX woocommerce-currency-switcher plugin for WordPress allows unauthenticated remote attackers to bypass access controls and gain read access to sensitive data through incorrectly configured security levels. The vulnerability affects FOX versions up to and including 1.4.5, with a CVSS score of 5.3 and extremely low exploitation probability (EPSS 0.02%), suggesting limited real-world attack incentive despite the missing authorization flaw.
Stored Cross-Site Scripting in TableOn - WordPress Posts Table Filterable plugin versions up to 1.0.4.4 allows authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript via unescaped shortcode attributes ('class', 'help_link', 'popup_title', 'help_title') in the 'tableon_button' shortcode. The vulnerability results from the do_shortcode_button() function extracting attributes without sanitization and the TABLEON_HELPER::draw_html_item() function concatenating these values directly into HTML output without escaping, enabling malicious scripts to execute in the browsers of users viewing affected pages. No public exploit code or active exploitation has been reported at this time.
A DOM-Based Cross-Site Scripting (XSS) vulnerability exists in the RealMag777 MDTF (Meta Data Filter and Taxonomy Filter) WordPress plugin affecting versions up to and including 1.3.5. An authenticated attacker with low privileges can inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions. The vulnerability requires user interaction (UI:R) and is classified as moderate severity (CVSS 6.5), though its exploitability depends on plugin popularity and whether public proof-of-concept code becomes available.
A DOM-Based Cross-Site Scripting (XSS) vulnerability exists in the RealMag777 Active Products Tables for WooCommerce plugin (versions up to 1.0.7), allowing authenticated users with low privileges to inject malicious scripts that execute in other users' browsers. The vulnerability has a moderate CVSS score of 6.5 but carries a low exploitation probability (EPSS 0.03%, percentile 8%), indicating minimal real-world active exploitation risk despite the technical severity.
Broken access control in the Husky Products Filter for WooCommerce plugin (realmag777) at version 1.4.6 and earlier allows remote, unauthenticated attackers to reach functionality that performs no authorization check, resulting in high-impact exposure of confidential data while integrity and availability remain unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) shows that no credentials or user interaction are required, and the CWE-862 classification confirms the root cause is a missing authorization check rather than a memory-safety or injection defect; the available sources do not identify the specific endpoint, action or feature that lacks the check. There is no CISA KEV listing and no public exploit identified at time of analysis, and the vuln.today priority decision is 'this_week'; no EPSS score was supplied with the intelligence.
Unauthenticated broken access control in the BEAR bulk-editor plugin for WordPress (vendor realmag777, plugin slug woo-bulk-editor) affects version 1.2.2 and earlier, letting network-reachable attackers invoke functionality that should require authorization without any login, token, or victim interaction. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3 HIGH) rates the technical impact as partial across confidentiality, integrity, and availability rather than full site compromise, and exploitation is gated primarily by deployment - only sites with this specific plugin version installed and active are exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the Patchstack report does not disclose the precise vulnerable endpoint or parameter.
Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The `filter_data[comment_count]` parameter is split on a colon delimiter and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()` sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis.
DOM-based cross-site scripting affects the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (slug profit-products-tables-for-woocommerce) in all versions through 1.1.0, letting a remote attacker deliver crafted input that is unsafely written into the DOM and executed as script in a victim's browser. Because the CVSS scope is changed (S:C) and no authentication is required (PR:N), successful exploitation can affect resources beyond the vulnerable component, though it requires the victim to interact with an attacker-influenced page or link (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Reflected/stored cross-site scripting in the WordPress plugin BEAR (realmag777's WooCommerce Bulk Editor and Products Manager, woo-bulk-editor) version 1.1.8 and earlier allows an unauthenticated remote attacker to inject malicious script that executes in a victim's browser when the victim is lured to interact with a crafted request. The CVSS:3.1 vector (AV:N/PR:N/UI:R/S:C) indicates network-reachable, no-authentication exploitation that requires user interaction and crosses a security scope boundary. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Patchstack.
Unauthenticated SQL injection in the InPost Gallery WordPress plugin (versions 2.1.4.6 and earlier) by realmag777 allows remote attackers to inject arbitrary SQL queries without any authentication. The flaw carries a CVSS 9.3 with a scope change, meaning successful exploitation can extract sensitive database contents and impact resources beyond the vulnerable component. No public exploit identified at time of analysis, but the unauthenticated nature and the visibility of Patchstack-reported WordPress flaws make opportunistic scanning likely.
Authenticated attackers with Contributor-level access can delete entire multi-currency configurations in FOX Currency Switcher Professional for WooCommerce by visiting any wp-admin page with a specific parameter, and the lack of nonce verification allows CSRF-based exploitation against administrators. Confirmed actively exploited (CISA KEV). CVSS 8.1 reflects high integrity and availability impact, with EPSS data unavailable. WordPress plugin affects versions ≤1.4.5, with patch released in version 1.4.6 per Wordfence advisory. The dual attack vectors (direct authenticated abuse and CSRF) significantly increase real-world risk for WooCommerce installations using this currency management plugin.
Blind SQL injection in BEAR woo-bulk-editor plugin for WordPress up to version 1.1.7.1 allows high-privilege authenticated administrators to extract database contents through specially crafted SQL queries. The scope change in CVSS (S:C) indicates potential impact beyond the plugin itself, enabling access to other WordPress data or resources. No public exploit code or active exploitation indicators identified at time of analysis, but Patchstack public disclosure increases weaponization risk.
Blind SQL injection in FOX WooCommerce Currency Switcher plugin (versions ≤1.4.5) allows authenticated high-privilege users to extract database contents via crafted SQL commands. Attacker requires high-privilege access (PR:H) but can breach scope boundaries (S:C), achieving high confidentiality impact and limited availability disruption. No public exploit identified at time of analysis. Affects WordPress installations using the vulnerable plugin for multi-currency e-commerce functionality.
SQL injection vulnerability in the RealMag777 WOLF bulk-editor WordPress plugin (versions up to 1.0.8.7) that allows authenticated administrators to execute blind SQL injection attacks. With a low EPSS score of 0.02% and no KEV listing, this vulnerability requires high privileges to exploit and is not currently being actively exploited in the wild.
The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes sensitive data to unauthenticated remote visitors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required to reach the exposure. The impact is rated moderate (CVSS 6.5) with limited confidentiality effect (C:L) and no availability impact, and the available sources do not specify which plugin feature, endpoint, or configuration actually triggers the disclosure or which data is revealed. Neither CISA KEV listing nor public exploit code is present in the supplied intelligence, and no EPSS score was provided, so this is tracked as a this-month remediation item rather than an emergency; exposure is limited to WordPress sites that have this specific plugin installed and active.
Sensitive information exposure in HUSKY - Products Filter for WooCommerce Professional through 1.4.5 allows unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password from the inline woof_tm_data script object on public frontend filter pages when the Statistics extension, saved external MySQL credentials, and Turbo Mode are all enabled. This is a moderate, conditional risk: default or internal-database configurations are not affected, and no public exploit was identified at time of analysis, but any site that has adopted those documented settings should treat the credentials as potentially exposed.
Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis.
Authorization bypass in FOX - Currency Switcher Professional for WooCommerce (all versions through 1.4.6) allows authenticated attackers with Subscriber-level access to impersonate higher-privileged roles - such as wholesale customers or administrators - to obtain discounted or otherwise role-restricted product pricing. The flaw stems from the plugin's fixed user-role pricing engine blindly trusting a client-supplied HTTP request parameter over the server-side session object when resolving a user's role for price calculation. No public exploit is identified at time of analysis, and real-world impact is bounded by a non-default configuration requirement, keeping the CVSS base score at 4.3.
Cross-Site Request Forgery in BEAR - Bulk Editor and Products Manager Professional for WooCommerce (all versions up to 1.1.5) allows unauthenticated attackers to modify WooCommerce product data including prices, descriptions, and other fields by tricking administrators or shop managers into clicking a malicious link, due to missing nonce validation in the woobe_redraw_table_row() function. CVSS 6.5 reflects the high integrity impact; no public exploit code or active exploitation has been confirmed at analysis time.
Cross-Site Request Forgery in BEAR - Bulk Editor and Products Manager Professional for WooCommerce (all versions up to 1.1.5) allows unauthenticated attackers to delete WooCommerce taxonomy terms via a malicious link that tricks site administrators or shop managers into performing an action. The vulnerability stems from missing nonce validation on the woobe_delete_tax_term() function, enabling integrity compromise with low CVSS impact (4.3) but requiring user interaction.
Missing authorization in RealMag777 FOX woocommerce-currency-switcher plugin for WordPress allows unauthenticated remote attackers to bypass access controls and gain read access to sensitive data through incorrectly configured security levels. The vulnerability affects FOX versions up to and including 1.4.5, with a CVSS score of 5.3 and extremely low exploitation probability (EPSS 0.02%), suggesting limited real-world attack incentive despite the missing authorization flaw.
Stored Cross-Site Scripting in TableOn - WordPress Posts Table Filterable plugin versions up to 1.0.4.4 allows authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript via unescaped shortcode attributes ('class', 'help_link', 'popup_title', 'help_title') in the 'tableon_button' shortcode. The vulnerability results from the do_shortcode_button() function extracting attributes without sanitization and the TABLEON_HELPER::draw_html_item() function concatenating these values directly into HTML output without escaping, enabling malicious scripts to execute in the browsers of users viewing affected pages. No public exploit code or active exploitation has been reported at this time.
A DOM-Based Cross-Site Scripting (XSS) vulnerability exists in the RealMag777 MDTF (Meta Data Filter and Taxonomy Filter) WordPress plugin affecting versions up to and including 1.3.5. An authenticated attacker with low privileges can inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions. The vulnerability requires user interaction (UI:R) and is classified as moderate severity (CVSS 6.5), though its exploitability depends on plugin popularity and whether public proof-of-concept code becomes available.
A DOM-Based Cross-Site Scripting (XSS) vulnerability exists in the RealMag777 Active Products Tables for WooCommerce plugin (versions up to 1.0.7), allowing authenticated users with low privileges to inject malicious scripts that execute in other users' browsers. The vulnerability has a moderate CVSS score of 6.5 but carries a low exploitation probability (EPSS 0.03%, percentile 8%), indicating minimal real-world active exploitation risk despite the technical severity.