CveMateVulnerability intelligence

Realmag777 vulnerabilities

127 vulnerabilities

Known vulnerabilities in Realmag777 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 26 products.

Products

26

BEAR – Bulk Editor And Products Manager Professional For Woocommerce By Pluginus.Net15 vulnerabilities
Husky – Products Filter Professional For Woocommerce11 vulnerabilities
Active Products Tables For Woocommerce8 vulnerabilities
BEAR8 vulnerabilities
WOLF – Wordpress Posts Bulk Editor And Manager Professional8 vulnerabilities
FOX – Currency Switcher Professional For Woocommerce7 vulnerabilities
MDTF7 vulnerabilities
Active Products Tables For Woocommerce. Use Constructor To Create Tables6 vulnerabilities
Tableon6 vulnerabilities
Wordpress Meta Data And Taxonomies Filter (Mdtf)6 vulnerabilities
WPCS – Wordpress Currency Switcher Professional6 vulnerabilities
Husky4 vulnerabilities
Husky – Products Filter For Woocommerce Professional4 vulnerabilities
Inpost Gallery4 vulnerabilities
MDTF – Meta Data And Taxonomies Filter4 vulnerabilities
WOLF4 vulnerabilities
WPCS4 vulnerabilities
FOX3 vulnerabilities
Tableon – Wordpress Posts Table Filterable3 vulnerabilities
Active Products Tables For Woocommerce. Professional Products Tables For Woocommerce Store2 vulnerabilities
Gmap Targeting2 vulnerabilities
Husky – Products Filter For Woocommerce (Formerly Woof)2 vulnerabilities
Taxonomy Chain Menu1 vulnerabilities
Woocs – Woocommerce Currency Switcher1 vulnerabilities
Wordpress Meta Data Filter & Taxonomies Filter1 vulnerabilities
WPCS Wordpress Currency Switcher1 vulnerabilities

CVE-2026-107646realmag777husky – products filter for woocommerce professional6d ago16-10-2026 06:40

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.CVE-2021-20781pluginuswordpress_meta_data_and_taxonomies_filter+25y ago14-07-2021 01:20

Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.CVE-2021-20780realmag777wpcs - wordpress currency switcher+25y ago07-07-2021 07:05

Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.CVE-2025-54707realmag777mdtf+11y ago14-08-2025 10:34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows SQL Injection.This issue affects MDTF: from n/a through <= 1.3.3.7.CVE-2025-2169realmag777wpcs – wordpress currency switcher professional+11y ago11-03-2025 03:22

The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.CVE-2025-13110realmag777husky – products filter professional for woocommerce+110mo ago18-12-2025 12:22

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.CVE-2025-13109realmag777husky – products filter professional for woocommerce+110mo ago03-12-2025 12:29

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.CVE-2025-52708realmag777husky+11y ago20-06-2025 15:03

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.7.CVE-2025-52732realmag777gmap targeting+11y ago14-08-2025 10:34

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 GMap Targeting gmap-targeting allows PHP Local File Inclusion.This issue affects GMap Targeting: from n/a through <= 1.1.6.CVE-2025-1661pluginushusky_-_products_filter_professional_for_woocommerce+21y ago11-03-2025 03:22

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.CVE-2025-1514realmag777active products tables for woocommerce. use constructor to create tables+11y ago26-03-2025 08:21

The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.CVE-2025-62069realmag777mdtf+112mo ago22-10-2025 14:32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.8.CVE-2025-62964realmag777mdtf+112mo ago27-10-2025 01:34

Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.6.CVE-2025-11735realmag777husky – products filter professional for woocommerce+111mo ago28-10-2025 05:27

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2025-26775pluginusbear_-_woocommerce_bulk_editor_and_products_manager_professional+21y ago17-02-2025 11:38

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 BEAR woo-bulk-editor allows Stored XSS.This issue affects BEAR: from n/a through <= 1.1.4.4.CVE-2025-26903realmag777inpost gallery+11y ago15-04-2025 21:53

Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Forgery.This issue affects InPost Gallery: from n/a through <= 2.1.4.3.CVE-2025-26890realmag777husky+11y ago27-03-2025 21:53

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.6.4.CVE-2025-48266realmag777active products tables for woocommerce+11y ago19-05-2025 14:45

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Stored XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.6.8.CVE-2025-0864pluginusactive_products_tables_for_woocommerce+21y ago18-02-2025 07:28

The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcodes_set' parameter in all versions up to, and including, 1.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2025-57889realmag777inpost gallery+11y ago05-09-2025 16:15

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 InPost Gallery inpost-gallery allows PHP Local File Inclusion.This issue affects InPost Gallery: from n/a through <= 2.1.4.5.