WordPress security by component

HUSKY – Products Filter Professional for WooCommerce

Plugin description

HUSKY – Products Filter Professional for WooCommerce adds catalog filtering using attributes, categories, tags, prices, and other product criteria.

HUSKY – Products Filter Professional for WooCommerce (woocommerce-products-filter) is a WordPress plugin with 17 published CVE records in this archive. The latest tracked vulnerability was published Sep 11, 2026; the highest published CVSS base score is 9.8.

Plugin slug: woocommerce-products-filter

Latest vulnerability

CVE-2026-18562: HUSKY – Products Filter for WooCommerce Professional: Cross-site scripting

HUSKY – Products Filter for WooCommerce Professional is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.4.3.

PublishedSep 11, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for woocommerce-products-filter
		Safe version
Sep 11, 2026	CVE-2026-18562 HUSKY – Products Filter for WooCommerce Professional: Cross-site scripting HUSKY – Products Filter for WooCommerce Professional is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.4.3.	See mitigation notes	CVE6.1 NVDPending
May 13, 2026	CVE-2020-37174 Products Filter Professional for WooCommerce: Cross-site scripting Products Filter Professional for WooCommerce is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is 1.2.3.	See mitigation notes	CVE4.8 NVDPending
Oct 28, 2025	CVE-2025-11735 HUSKY – Products Filter Professional for WooCommerce: SQL injection HUSKY – Products Filter Professional for WooCommerce is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.5 NVDPending
Jun 20, 2025	CVE-2025-52708 HUSKY: Filesystem traversal HUSKY is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5 NVDPending
Mar 27, 2025	CVE-2025-26890 HUSKY: Filesystem traversal HUSKY is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5 NVDPending
Mar 11, 2025	CVE-2025-1661 HUSKY – Products Filter Professional for WooCommerce: Filesystem traversal HUSKY – Products Filter Professional for WooCommerce is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8 NVDPending
Nov 19, 2024	CVE-2024-11400 HUSKY – Products Filter Professional for WooCommerce: Cross-site scripting HUSKY – Products Filter Professional for WooCommerce is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending
Aug 13, 2024	CVE-2024-43121 HUSKY: Privilege escalation or authentication bypass HUSKY is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE9.1 NVD7.2
Jul 16, 2024	CVE-2024-6457 HUSKY – Products Filter Professional for WooCommerce: SQL injection HUSKY – Products Filter Professional for WooCommerce is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.8 NVD7.5
May 29, 2024	CVE-2024-5039 HUSKY – Products Filter Professional for WooCommerce: Cross-site scripting HUSKY – Products Filter Professional for WooCommerce is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD6.4
May 17, 2024	CVE-2024-32680 HUSKY – Products Filter for WooCommerce (formerly WOOF): Filesystem traversal HUSKY – Products Filter for WooCommerce (formerly WOOF) is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE8.8 NVD8.8
Mar 29, 2024	CVE-2024-30462 HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-site request forgery HUSKY – Products Filter for WooCommerce (formerly WOOF) is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8
Mar 15, 2024	CVE-2023-50861 HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-site request forgery HUSKY – Products Filter for WooCommerce (formerly WOOF) is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8
Dec 20, 2023	CVE-2023-40010 HUSKY – Products Filter for WooCommerce Professional: SQL injection HUSKY – Products Filter for WooCommerce Professional is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.3 NVD9.8
Feb 01, 2022	CVE-2021-25085 WOOF: Cross-site scripting WOOF is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Mar 14, 2018	CVE-2018-8711 Woocommerce Products Filter: Filesystem traversal Woocommerce Products Filter is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVEPending NVD9.8
Mar 14, 2018	CVE-2018-8710 Woocommerce Products Filter: Code execution Woocommerce Products Filter is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVEPending NVD9.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers