CVE-2025-8416

🗓️ 25 Oct 2025 06:49:24Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 10 Views

CVE-2025-8416: WordPress Product Filter by WBW up to 2.9.7 allows unauthenticated SQL injection via the filtersDataBackend parameter.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-8416	25 Oct 202510:56	–	circl
CNNVD	WordPress plugin Product Filter by WBW SQL注入漏洞	26 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-8416 Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection	25 Oct 202506:49	–	cvelist
EUVD	EUVD-2025-35920	25 Oct 202509:32	–	euvd
NVD	CVE-2025-8416	25 Oct 202507:15	–	nvd
Patchstack	WordPress Product Filter by WBW plugin <= 2.9.7 - Unauthenticated SQL Injection vulnerability	25 Oct 202503:08	–	patchstack
Positive Technologies	PT-2025-43726	25 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-8416	26 Oct 202507:16	–	redhatcve
Vulnrichment	CVE-2025-8416 Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection	25 Oct 202506:49	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (October 20, 2025 to October 26, 2025)	30 Oct 202516:01	–	wordfence

Vulners

Node

woobewoo product_filter_for_woocommerce_by_wbwRange≤2.9.7wordpress

[
  {
    "vendor": "woobewoo",
    "product": "Product Filter for WooCommerce by WBW",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.9.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/mod.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/controller.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8

15 Apr 2026 00:35Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.17.5

EPSS0.00123

SSVC

CWE-89