WordPress security by component
Doofinder for WooCommerce
Plugin description
Doofinder for WooCommerce is a WordPress component with 5 published CVE records in this archive. The latest tracked vulnerability was published Apr 08, 2026; the highest CVE/CNA score is 7.1.
Plugin slug:
doofinder-for-woocommerceLatest vulnerability
CVE-2026-39542: Doofinder for WooCommerce: A security weakness
Doofinder for WooCommerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.10.13.
| Safe version |
|
||
|---|---|---|---|
| Apr 08, 2026 |
CVE-2026-39542
Doofinder for WooCommerce: A security weakness
Doofinder for WooCommerce is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.10.13.
|
2.10.14 |
CVE5.3
NVDPending
|
| Mar 15, 2024 |
CVE-2024-25596
Doofinder for WooCommerce: Cross-site scripting
Doofinder for WooCommerce is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|
| Jan 05, 2024 |
CVE-2023-51678
Doofinder WP & WooCommerce Search: Cross-site request forgery
Doofinder WP & WooCommerce Search is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD6.5
|
| Dec 19, 2023 |
CVE-2023-40602
Doofinder WP & WooCommerce Search: An open redirect
Doofinder WP & WooCommerce Search is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.
|
See mitigation notes |
CVE4.7
NVD6.1
|
| Dec 15, 2023 |
CVE-2023-49185
Doofinder WP & WooCommerce Search: Cross-site scripting
Doofinder WP & WooCommerce Search is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVD6.1
|