Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Add Tabs Xforwc Plugin | — | Update add-tabs-xforwc plugin to version 1.5.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Bulk Add To Cart Xforwc Plugin | — | Update bulk-add-to-cart-xforwc plugin to version 1.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Floating Cart Xforwc Plugin | — | Update floating-cart-xforwc plugin to version 1.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Improved Sale Badges Plugin | — | Update improved-sale-badges plugin to version 4.4.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Improved Variable Product Attributes Plugin | — | Update improved-variable-product-attributes plugin to version 5.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Live Search Xforwc Plugin | — | Update live-search-xforwc plugin to version 2.1.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Package Quantity Xforwc Plugin | — | Update package-quantity-xforwc plugin to version 1.2.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Prdctfltr Plugin | — | Update prdctfltr plugin to version 8.2.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Price Commander Xforwc Plugin | — | Update price-commander-xforwc plugin to version 1.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Product Loops Plugin | — | Update product-loops plugin to version 1.7.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Seo For Woocommerce Plugin | — | Update seo-for-woocommerce plugin to version 1.6.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Share Print Pdf Woocommerce Plugin | — | Update share-print-pdf-woocommerce plugin to version 2.8.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Spam Control Xforwc Plugin | — | Update spam-control-xforwc plugin to version 1.5.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Woocommerce Frontend Shop Manager Plugin | — | Update woocommerce-frontend-shop-manager plugin to version 4.7.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Woocommerce Warranties And Returns Plugin | — | Update woocommerce-warranties-and-returns plugin to version 5.3.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
| Xforwoocommerce Plugin | — | Update xforwoocommerce plugin to version 1.7.0, or a newer patched version | May 15, 2025 | Sep 7, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub