CVE-2025-11391

Unauthenticated Blind SQL Injection in PPOM for WooCommerce prefix . PPOMTABLEMETA . " WHERE productmetaid = $metaid"; $res = $wpdb-getrow $qry ; return $res; An unauthenticated attacker can exploit this by crafting a malicious payload and injecting it into the ppomfieldsid parameter when adding ...

CVE-2025-11391

PPOM for WooCommerce prefix . PPOMTABLEMETA . " WHERE productmetaid = $metaid"; $res = $wpdb-getrow $qry ; return $res; 인증되지 않은 공격자는 악성 페이로드를 제작하여 제품을 장바구니에 추가할 때 ppomfieldsid 매개변수에 주입함으로써 이를 악용할 수 있습니다. 이를 통해 공격자는 시간 지연 함수SLEEP와 같은 임의의 SQL 명령을 실행할 수 있으며, 취약점을 확인하고 잠재적으로 데이터베이스에서 민감한 정보를 문자 단위로 추...

CVE-2026-56050

CVE-2026-56050 affects the WordPress PPOM for WooCommerce plugin (Themeisle) up to version 33.0.18. The issue is described as an Improper Access Control vulnerability, arising from incorrectly configured access control security levels within the PPOM for WooCommerce feature set. The available doc...

WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Plugin PPOM for WooCommerce versions = 33.0.18...

CVE-2026-56050: Improper Access Control

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18...

CVE-2025-66069 WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through = 33.0.16...

CVE-2025-66069

CVE-2025-66069 (WordPress PPOM for WooCommerce) is a Missing Authorization / Broken Access Control vulnerability affecting PPOM for WooCommerce versions up to 33.0.16. The issue, reported by Legion Hunter, arises from incorrectly configured access controls in the woocommerce-product-addon feature...

CVE-2025-66069: Missing Authorization

Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through = 33.0.16...

WordPress plugin PPOM for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

EUVD-2025-3863

Malicious code in bioql PyPI...

CVE-2025-24668 WordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Stored XSS.This issue affects PPOM for WooCommerce: from n/a through = 33.0.8...

PT-2025-5489 · Woocommerce · Ppom For Woocommerce

Name of the Vulnerable Software and Affected Versions: PPOM for WooCommerce versions n/a through 33.0.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

CVE-2025-24668: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Stored XSS.This issue affects PPOM for WooCommerce: from n/a through = 33.0.8...

CVE-2024-35728: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Themeisle PPOM for WooCommerce allows Code Inclusion.This issue affects PPOM for WooCommerce: from n/a through 32.0.20...

PT-2024-26679

Name of the Vulnerable Software and Affected Versions PPOM for WooCommerce versions through 32.0.20 Description The issue is related to an Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as an 'Injection' vulnerability, in Themeisle PPOM for...

WordPress PPOM for WooCommerce Plugin < 32.0.7 is vulnerable to Cross Site Scripting (XSS)

Software PPOM for WooCommerce Type Plugin Vulnerable versions 32.0.7 Fixed in 32.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2256 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID f58b7e5c3a3c Credits Alex Sanford...

WordPress 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blogging sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress PPOM for WooCommerce plugin...

CVE-2021-25018: Missing Authorization

The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppomsettingspanelaction AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS...

PT-2022-9575

Name of the Vulnerable Software and Affected Versions PPOM for WooCommerce WordPress plugin versions prior to 24.0 Description The issue concerns a lack of authorisation and CSRF checks in the ppom settings panel action AJAX action, allowing any authenticated user to call it and set arbitrary...