Woobewoo
Monthly
WBW Product Filter for WooCommerce through version 3.4.6 lets unauthenticated remote attackers enumerate draft, future and pending WooCommerce products, including their counts and rendered listing markup, and force unbounded product queries through the plugin's frontend AJAX action. The handler lacks capability and nonce checks and merges attacker-supplied query arguments into WP_Query, overriding the plugin's safe defaults. No public exploit was identified at time of analysis, the issue is not in CISA KEV, and no EPSS score was provided; CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting read-only confidentiality impact.
Reflected cross-site scripting in the Product Filter for WooCommerce by WBW WordPress plugin affects every release up to and including 3.4.6, and notably still affects sites that applied the incomplete 3.4.3 patch. The 'wpf_fid' value taken from the JSON-decoded filterSettings payload reaches the plugin's filter response path without absint() sanitization - only the separate getVar() read path was hardened - so an unauthenticated attacker who convinces a victim to click a crafted link can execute arbitrary script in that victim's browser session on the targeted site. Exploitation is per-victim and requires user interaction (UI:R), there is no persistent payload, and no public exploit code or active exploitation has been identified at time of analysis (priority label: this_month, CVSS 6.1).
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. Successful exploitation requires social engineering - a victim must click a crafted URL targeting a store page where the plugin's filter recalculation output is rendered - enabling session hijacking, credential theft, or further escalation against authenticated users including store administrators.
The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to 3.1.2) contains a critical authentication bypass vulnerability that allows unauthenticated attackers to permanently delete all filter configurations by truncating the wp_wpf_filters database table. The vulnerability stems from the plugin's MVC framework registering unauthenticated AJAX handlers without capability checks, combined with a magic method that forwards calls to the model layer and a permission check that defaults to true. An attacker can exploit this with a single crafted AJAX request, resulting in complete data loss and service disruption for WooCommerce installations using this plugin.
The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.9.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.8.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WBW Product Filter for WooCommerce through version 3.4.6 lets unauthenticated remote attackers enumerate draft, future and pending WooCommerce products, including their counts and rendered listing markup, and force unbounded product queries through the plugin's frontend AJAX action. The handler lacks capability and nonce checks and merges attacker-supplied query arguments into WP_Query, overriding the plugin's safe defaults. No public exploit was identified at time of analysis, the issue is not in CISA KEV, and no EPSS score was provided; CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting read-only confidentiality impact.
Reflected cross-site scripting in the Product Filter for WooCommerce by WBW WordPress plugin affects every release up to and including 3.4.6, and notably still affects sites that applied the incomplete 3.4.3 patch. The 'wpf_fid' value taken from the JSON-decoded filterSettings payload reaches the plugin's filter response path without absint() sanitization - only the separate getVar() read path was hardened - so an unauthenticated attacker who convinces a victim to click a crafted link can execute arbitrary script in that victim's browser session on the targeted site. Exploitation is per-victim and requires user interaction (UI:R), there is no persistent payload, and no public exploit code or active exploitation has been identified at time of analysis (priority label: this_month, CVSS 6.1).
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. Successful exploitation requires social engineering - a victim must click a crafted URL targeting a store page where the plugin's filter recalculation output is rendered - enabling session hijacking, credential theft, or further escalation against authenticated users including store administrators.
The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to 3.1.2) contains a critical authentication bypass vulnerability that allows unauthenticated attackers to permanently delete all filter configurations by truncating the wp_wpf_filters database table. The vulnerability stems from the plugin's MVC framework registering unauthenticated AJAX handlers without capability checks, combined with a magic method that forwards calls to the model layer and a permission check that defaults to true. An attacker can exploit this with a single crafted AJAX request, resulting in complete data loss and service disruption for WooCommerce installations using this plugin.
The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.9.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Request Forgery (CSRF) vulnerability in WBW Product Table by WBW.8.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.