7.2Yüksek

CVE-2026-22480WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability

WebToffee Product Feed for WooCommerce Yayım: 2026-03-25 19:14 (7 ay önce)

Açıklama

Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.

Zayıflık türü (CWE): CWE-502

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
WebToffee	Product Feed for WooCommerce	≤ 2.3.3

Kaynaklar ve yamalar

https://patchstack.com/database/Wordpress/Plugin/webtoffee-product-feed/vulnerability/wordpress-product-feed-… vdb-entry

CVSS puanı

7.2Yüksek

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yüksek
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (2)

cna	CVSS 3.1	7.2Yüksek
audit@patchstack.com	CVSS 3.1	7.2Yüksek

EPSS (30 günde istismar olasılığı)

0.53%

tüm CVE'lerin %46'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-01-07
Yayımlandı2026-03-25 19:14
IP-DB'ye ulaştı2026-10-24 23:46
Son güncelleme2026-06-17 13:19

Numarayı veren (CNA): Patchstack
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

7.5Yüksek

CVE-2026-82663 1 saat önce

Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload

GiveWP Give - Peer-to-Peer

The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthe…

7.5Yüksek

CVE-2026-82568 1 saat önce

Give - Peer-to-Peer <= 2.9.3 - Unauthenticated SQL Injection via 'sort' Parameter

GiveWP Give - Peer-to-Peer

The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the e…

Puansız

CVE-2026-124671 4 saat önce

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather th…

Puansız

CVE-2026-124673 4 saat önce

Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclo…

Puansız

CVE-2026-127048 4 saat önce

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…

Puansız

CVE-2026-110989 4 saat önce

RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission

RegistrationMagic

The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administ…