CVE-2025-8416highCWE-89

CVE-2025-8416: falha de alta gravidade em woobewoo Product Filter for WooCommerce by WBW

Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Product Filter for WooCommerce by WBW

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.4%
The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
woobewoo · Product Filter for WooCommerce by WBW
CVEs relacionadas — woobewoo Product Filter for WooCommerce by WBW

No mesmo produto, das mais perigosas para as menos.

CVE-2025-2317HIGHProduct Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend ParameterEPSS 0.5%CVE-2026-7804MEDIUMProduct Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' ParameterEPSS 0.5%CVE-2021-4444HIGHProduct Filter by WooBeWoo <= 1.4.9 - Missing AuthorizationEPSS 0.3%CVE-2025-11269MEDIUMProduct Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings UpdateEPSS 0.3%CVE-2026-3138MEDIUMProduct Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLEEPSS 0.3%CVE-2026-88942MEDIUMProduct Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON ParameterEPSS 0.3%