CVEs we hold for Product

Records whose assigning authority named Product as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-87919Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via ShortcodeUnknown Product XML Feed Manager for WooCommerce

CVE-2026-87771Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and readUnknown Product Question and Answer

CVE-2026-3830Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLiUnknown Product Filter for WooCommerce by WBW

CVE-2026-19089Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File UploadUnknown Product Input Fields for WooCommerce

CVE-2026-16950Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_productsUnknown Product Shortlist

CVE-2026-16611Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration DisclosureUnknown Product Feed PRO for WooCommerce by AdTribes

CVE-2026-16285WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media DownloadUnknown Product Attachment for WooCommerce

CVE-2026-15258Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed FilterUnknown Product Feed Manager For WooCommerce

CVE-2026-12968Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG UploadUnknown Product Addons and Product Options With Custom…

CVE-2026-11568Product Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_dataUnknown Product Configurator for WooCommerce

CVE-2025-8394Productive Style <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb…productiveminds Productive Style – Optimisations & Content…

CVE-2025-47657WordPress Productive Commerce plugin <= 1.1.40 - SQL Injection vulnerabilityProductive Commerce

CVE-2025-22320WordPress ProductDyno plugin <= 1.0.24 - Reflected Cross Site Scripting (XSS) vulnerabilityProductDyno

CVE-2024-51855WordPress Redirecter plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityProductineer Redirecter

CVE-2024-3964Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSSUnknown Product Enquiry for WooCommerce

CVE-2024-12109Product Labels For Woocommerce < 1.5.9 - Admin+ SQLiUnknown Product Labels For Woocommerce (Sale Badges)

CVE-2024-10638Product Labels For Woocommerce < 1.5.11 - Admin+ SQLiUnknown Product Labels For Woocommerce (Sale Badges)

CVE-2023-7151Product Enquiry for WooCommerce < 3.2 - Reflected XSSUnknown Product Enquiry for WooCommerce

CVE-2023-6626Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSSUnknown Product Enquiry for WooCommerce

CVE-2023-6625Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRFUnknown Product Enquiry for WooCommerce

CVE-2023-5348Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting UpdateUnknown Product Catalog Mode For WooCommerce

CVE-2023-2256Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site ScriptingUnknown Product Addons & Fields for WooCommerce

CVE-2023-1839Product Addons & Fields for WooCommerce < 32.0.6 - Admin+ Stored Cross-Site ScriptingUnknown Product Addons & Fields for WooCommerce

CVE-2023-1805Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSUnknown Product Catalog Feed by PixelYourSite

CVE-2023-1804Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSUnknown Product Catalog Feed by PixelYourSite

CVE-2023-0537Product Slider For WooCommerce Lite <= 1.1.7 - Contributor+ Stored XSSUnknown Product Slider For WooCommerce Lite

CVE-2023-0166PickPlugins Product Slider for WooCommerce < 1.13.42 - Contributor+ Stored XSSUnknown Product Slider for WooCommerce by PickPlugins

CVE-2023-0068Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Contributor+ Stored XSSUnknown Product GTIN (EAN, UPC, ISBN) for WooCommerce

CVE-2022-50950Webile 1.0.1 Directory Traversal Vulnerability via Web ApplicationProduct Owner: Webile Webile

CVE-2022-4791Product Slider and Carousel with Category for WooCommerce < 2.8 - Contributor+ Stored XSS via ShortcodeUnknown Product Slider and Carousel with Category for…

CVE-2022-4629Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in ShortcodeUnknown Product Slider for WooCommerce

CVE-2022-4329Product list Widget for Woocommerce <= 1.0 - Reflected XSSUnknown Product list Widget for Woocommerce

CVE-2022-3451Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX CallsUnknown Product Stock Manager

CVE-2022-2382Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options DeletionUnknown Product Slider for WooCommerce

CVE-2022-1953Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File DeletionUnknown Product Configurator for WooCommerce

CVE-2022-1020Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function CallUnknown Product Table for WooCommerce (wooproducttable)

CVE-2022-0426Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site ScriptingUnknown Product Feed PRO for WooCommerce

CVE-2021-24974Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSSUnknown Product Feed PRO for WooCommerce

CVE-2021-24511Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL InjectionUnknown Product Feed on WooCommerce for Google, Awin…

39 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.