Product Feed Manager
Product Feed Manager generates product feeds from WooCommerce products for external marketplaces and shopping services.
Product Feed Manager (best-woocommerce-feed) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 8.5.
best-woocommerce-feedCVE-2026-118093: Product Feed Manager: Missing authorization
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 7.14.1.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-118093
Product Feed Manager: Missing authorization
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 7.14.1.
|
7.14.2 |
CVE5.3
|
| Sep 17, 2026 |
CVE-2026-66580
Product Feed Manager permits SQL injection with Contributor access
Product Feed Manager through 7.12.0 has an SQL-injection flaw requiring Contributor access according to the CNA description. The disclosed class is attacker-influenced input being interpreted as part of an SQL command; the export does not identify the input parameter, endpoint, handler, query or encoding, so the exact path cannot be established. The CNA vector indicates high confidentiality impact and limited availability impact, without user interaction; it does not establish database modification or operating-system code execution. The affected-version data marks 7.12.1 unaffected.
|
7.12.1 |
CVE8.5
|
| Jul 27, 2026 |
CVE-2026-59553
Product Feed Manager public input permits cross-site scripting
Product Feed Manager through 7.6.1 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the store's origin.
|
7.6.2 |
CVE7.1
|
| Jul 16, 2026 |
CVE-2026-15306
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces: Cross-site scripting
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 7.6.1.
|
7.6.2 |
CVE6.1
|
| Apr 15, 2024 |
CVE-2023-52144
Product Feed Manager: Filesystem traversal
Product Feed Manager is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE5.5
|