Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Add Tabs Xforwc Plugin | — | Update add-tabs-xforwc plugin to version 1.5.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Bulk Add To Cart Xforwc Plugin | — | Update bulk-add-to-cart-xforwc plugin to version 1.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Floating Cart Xforwc Plugin | — | Update floating-cart-xforwc plugin to version 1.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Improved Sale Badges Plugin | — | Update improved-sale-badges plugin to version 4.4.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Improved Variable Product Attributes Plugin | — | Update improved-variable-product-attributes plugin to version 5.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Live Search Xforwc Plugin | — | Update live-search-xforwc plugin to version 2.1.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Package Quantity Xforwc Plugin | — | Update package-quantity-xforwc plugin to version 1.2.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Prdctfltr Plugin | — | Update prdctfltr plugin to version 8.2.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Price Commander Xforwc Plugin | — | Update price-commander-xforwc plugin to version 1.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Product Loops Plugin | — | Update product-loops plugin to version 1.7.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Seo For Woocommerce Plugin | — | Update seo-for-woocommerce plugin to version 1.6.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Share Print Pdf Woocommerce Plugin | — | Update share-print-pdf-woocommerce plugin to version 2.8.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Spam Control Xforwc Plugin | — | Update spam-control-xforwc plugin to version 1.5.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Woocommerce Frontend Shop Manager Plugin | — | Update woocommerce-frontend-shop-manager plugin to version 4.7.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Woocommerce Warranties And Returns Plugin | — | Update woocommerce-warranties-and-returns plugin to version 5.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Xforwoocommerce Plugin | — | Update xforwoocommerce plugin to version 1.7.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub