Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
HUSKY - Security Vulnerability (CVE-2026-116401)
Unauthenticated Broken Access Control in HUSKY
PLUGIN
HUSKY
CVE-2026-116401
Risk Score
Threat Entry
Updated 2026-09-22
HUSKY - Security Vulnerability (CVE-2026-92969)
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users…
PLUGIN
HUSKY
CVE-2026-92969
Risk Score
Threat Entry
Updated 2026-09-11
HUSKY - Cross-Site Scripting (XSS) (CVE-2026-18562)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can…
PLUGIN
HUSKY
CVE-2026-18562
Risk Score
Threat Entry
Updated 2026-08-26
HUSKY - Path Traversal (CVE-2026-15244)
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.
PLUGIN
HUSKY
CVE-2026-15244
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Security Vulnerability (CVE-2025-13110)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.
PLUGIN
HUSKY
CVE-2025-13110
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Security Vulnerability (CVE-2025-13109)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.
PLUGIN
HUSKY
CVE-2025-13109
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - SQL Injection (CVE-2025-11735)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
HUSKY
CVE-2025-11735
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Path Traversal (CVE-2025-1661)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
HUSKY
CVE-2025-1661
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Cross-Site Scripting (XSS) (CVE-2024-11400)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter in all versions up to, and including, 1.3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
HUSKY
CVE-2024-11400
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Security Vulnerability (CVE-2024-7491)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be…
PLUGIN
HUSKY
CVE-2024-7491
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - SQL Injection (CVE-2024-6457)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
HUSKY
CVE-2024-6457
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Cross-Site Scripting (XSS) (CVE-2024-5039)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
HUSKY
CVE-2024-5039
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Path Traversal (CVE-2024-3061)
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
HUSKY
CVE-2024-3061
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - Cross-Site Scripting (XSS) (CVE-2024-1796)
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'swoof_slug'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
HUSKY
CVE-2024-1796
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - SQL Injection (CVE-2024-1795)
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
HUSKY
CVE-2024-1795
Risk Score
Threat Entry
Updated 2026-06-17
HUSKY - PHP Object Injection (CVE-2022-4489)
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
PLUGIN
HUSKY
CVE-2022-4489
Risk Score