Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 391,181 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?HUSKY – Products Filter for WooCommerce (formerly WOOF)SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)FunnelKit CheckoutWooBeWoo Product Filter ProWooFramework BrandingWooFramework Tweaks
Plugin · woocommerce-products-filter
HUSKY – Products Filter for WooCommerce (formerly WOOF)
30 known vulnerabilities on record. Add your version above to see which ones affect you.
Is HUSKY – Products Filter for WooCommerce (formerly WOOF) safe? The full page →
Oct 30, 2026Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.CVE-2026-116401 · affects up to 1.4.6 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
Oct 30, 2026Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.CVE-2026-115947 · affects up to 1.4.6 · reported by PatchstackMedium 6.5
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
Oct 16, 2026HUSKY – Products Filter for WooCommerce Professional: Sensitive Information ExposureCVE-2026-107646 · affects up to 1.4.5 · reported by WordfenceMedium 5.3
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026HUSKY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95608 · affects up to 1.4.3.2 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.
Sep 22, 2026HUSKY – Products Filter for WooCommerce Professional: Local File InclusionCVE-2026-92969 · affects up to 1.4.4 · reported by WordfenceHigh 8.1
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026HUSKY – Products Filter Professional for WooCommerce: Reflected Cross-Site ScriptingCVE-2026-18562 · affects up to 1.4.3 · reported by WordfenceMedium 6.1
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026HUSKY: Does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion pathCVE-2026-15244 · fixed in 1.4.1 · reported by WPScanHigh 7.2
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.
May 13, 2026WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scriCVE-2020-37174 · reported by VulnCheckMedium 4.8
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design tab textfields. Attackers can inject JavaScript code through fields like 'Text for block toggle' and 'Custom front css styles' that executes on frontend pages when saved, affecting all site visitors.
Dec 18, 2025HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2025-13110 · affects up to 1.3.7.3 · reported by WordfenceMedium 4.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2025HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2025-13109 · affects up to 1.3.7.2 · reported by WordfenceMedium 4.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.
Oct 28, 2025HUSKY – Products Filter Professional for WooCommerce: Blind SQL InjectionCVE-2025-11735 · affects up to 1.3.7.1 · reported by WordfenceHigh 7.5
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Jun 20, 2025HUSKY: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52708 · affects up to 1.3.7 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.7.
Mar 27, 2025HUSKY: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26890 · affects up to 1.3.6.4 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.6.4.
Mar 11, 2025HUSKY – Products Filter Professional for WooCommerce: Local File InclusionCVE-2025-1661 · affects up to 1.3.6.5 · reported by WordfenceCritical 9.8
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024HUSKY: Missing AuthorizationCVE-2023-40334 · affects up to 1.3.4.2 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RealMag777 HUSKY woocommerce-products-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HUSKY: from n/a through <= 1.3.4.2.
Nov 19, 2024HUSKY – Products Filter Professional for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-11400 · affects up to 1.3.6.3 · reported by WordfenceMedium 6.1
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter in all versions up to, and including, 1.3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Sep 24, 2024HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2024-7491 · affects up to 1.3.6.1 · reported by WordfenceMedium 5.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.
Aug 13, 2024HUSKY: Improper Privilege ManagementCVE-2024-43121 · affects up to 1.3.6.1 · reported by PatchstackCritical 9.1
Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.
Jul 16, 2024HUSKY – Products Filter Professional for WooCommerce: Time-based SQL InjectionCVE-2024-6457 · affects up to 1.3.6 · reported by WordfenceCritical 9.8
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 29, 2024HUSKY – Products Filter Professional for WooCommerce: Stored Cross-Site ScriptingCVE-2024-5039 · affects up to 1.3.5.3 · reported by WordfenceMedium 6.4
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection')CVE-2024-32680 · affects up to 1.3.5.2 · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.
Mar 29, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-Site Request Forgery (CSRF)CVE-2024-30462 · affects up to 1.3.5.1 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.1.
Mar 29, 2024HUSKY – Products Filter Professional for WooCommerce: Local File InclusionCVE-2024-3061 · affects up to 1.3.5.2 · reported by WordfenceHigh 7.2
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Mar 15, 2024HUSKY – Products Filter for WooCommerce (formerly WOOF): Cross-Site Request Forgery (CSRF)CVE-2023-50861 · affects up to 1.3.4.3 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.
Mar 15, 2024HUSKY – Products Filter for WooCommerce Professional: Stored Cross-Site ScriptingCVE-2024-1796 · affects up to 1.3.5.1 · reported by WordfenceMedium 6.4
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'swoof_slug'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mar 15, 2024HUSKY – Products Filter for WooCommerce Professional: SQL InjectionCVE-2024-1795 · affects up to 1.3.5.2 · reported by WordfenceHigh 8.8
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Dec 20, 2023HUSKY – Products Filter for WooCommerce Professional: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-40010 · affects up to 1.3.4.2 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional.This issue affects HUSKY – Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.
Feb 6, 2023HUSKY: Unserializes user input provided via the settingsCVE-2022-4489 · fixed in 1.3.2 · reported by WPScanHigh 7.2
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Mar 14, 2018A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode paCVE-2018-8711 · fixed in 2.2.0 · reported by MITRECritical 9.8
A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.
Mar 14, 2018A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode pCVE-2018-8710 · fixed in 2.2.0 · reported by MITRECritical 9.8
A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.