WordPress woocommerce-products-filter has 11 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-1661 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a | critical | 9.8 | <1.3.6.6 | 1.3.6.6 |
| CVE-2024-6457 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author | critical | 9.8 | <1.3.6.1 | 1.3.6.1 |
| CVE-2018-8710 | A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrate | critical | 9.8 | <2.2.0 | 2.2.0 |
| CVE-2018-8711 | A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated | critical | 9.8 | <2.2.0 | 2.2.0 |
| CVE-2021-25085 | The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leadi | medium | 6.1 | <1.2.6.3 | 1.2.6.3 |
| CVE-2024-3061 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a | high | 7.2 | <1.3.5.3 | 1.3.5.3 |
| CVE-2024-1795 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the | high | 8.8 | <=1.3.5.2 | – |
| CVE-2024-1796 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | <1.3.5.2 | 1.3.5.2 |
| CVE-2024-11400 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really | medium | 6.1 | <=1.3.6.3 | – |
| CVE-2024-5039 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's | medium | 6.4 | <1.3.6 | 1.3.6 |
| CVE-2024-7491 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versi | medium | 5.3 | <1.3.6.2 | 1.3.6.2 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked