CVE-2018-8710

A remote code execution issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication...

CVE-2018-8711

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

CVE-2018-8711

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

Input validation

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

CVE-2018-8711

The CVE-2018-8711 entry concerns the WooCommerce Products Filter (WOOF) WordPress plugin prior to 2.2.0. The vulnerability arises from insufficient validation of arguments in render_html before it is passed to PHP’s extract(), allowing an attacker-supplied input to overwrite the $pagepath variabl...

CVE-2018-8710

CVE-2018-8710 affects the WordPress plugin WooCommerce Products Filter (WOOF) prior to version 2.2.0. The vulnerability arises from a page redraw AJAX function in an unauthenticated endpoint used by the shortcode parameter in a woof_redraw_woof action, which causes WordPress shortcode markup in t...

CVE-2018-8710: Improper Authentication

A remote code execution issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication...