Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-12
Advanced Product Fields (Product Addons) for WooCommerce - Security Vulnerability (CVE-2026-119171)
The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price.
PLUGIN
Advanced Product Fields (Product Addons) for WooCommerce
CVE-2026-119171
Risk Score
Threat Entry
Updated 2026-10-12
Advanced Product Fields (Product Addons) for WooCommerce - Improper Input Validation (CVE-2026-2996)
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.
PLUGIN
Advanced Product Fields (Product Addons) for WooCommerce
CVE-2026-2996
Risk Score
Threat Entry
Updated 2026-06-17
Advanced Product Fields (Product Addons) for WooCommerce - Cross-Site Request Forgery (CSRF) (CVE-2025-13924)
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Advanced Product Fields (Product Addons) for WooCommerce
CVE-2025-13924
Risk Score