7.6High

CVE-2025-47643WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection Vulnerability

ELEXtensions ELEX Product Feed for WooCommerce Published: 2025-05-07 17:20 (1 year ago)

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.

Weakness (CWE): CWE-89

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
ELEXtensions	ELEX Product Feed for WooCommerce	≤ 3.1.2

References and patches

https://patchstack.com/database/wordpress/plugin/elex-product-feed/vulnerability/wordpress-elex-product-feed-… vdb-entry

CVSS score

7.6High

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

All scores (2)

cna	CVSS 3.1	7.6High
audit@patchstack.com	CVSS 3.1	7.6High

EPSS (chance of exploitation in 30 days)

0.44%

higher than 39% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2025-05-07
Published2025-05-07 17:20
Reached IP-DB2026-10-24 23:59
Last updated2026-06-17 12:28

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

5.3Medium

CVE-2026-128834 14 minutes ago

WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability

Brainstorm Force Spectra

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5.

5.3Medium

CVE-2026-121771 15 minutes ago

WordPress Gutenberg Blocks plugin <= 3.7.6 - Sensitive Data Exposure vulnerability

PublishPress Gutenberg Blocks

Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6.

5.3Medium

CVE-2026-125815 16 minutes ago

WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability

Noah Hearle We’re Open!

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8.

5.4Medium

CVE-2026-118587 3 hours ago

PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes

blubrry PowerPress Podcasting plugin by Blubrry

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it pos…

9.8Critical

CVE-2026-119077 3 hours ago

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter

elextensions ELEX WordPress HelpDesk & Customer Ticketing System

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form s…

6.4Medium

CVE-2026-126029 3 hours ago

WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters

wpzoom WPZOOM Addons for Elementor – Starter Templates & Widgets

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versi…