Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · product-input-fields-for-woocommerce
Product Input Fields for WooCommerce
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Product Input Fields for WooCommerce safe? The full page →
Aug 10, 2026Product Input Fields for WooCommerce: Does not validate uploaded file typesCVE-2026-19089 · fixed in 2.0.2 · reported by WPScanCritical 9.8
The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules.
Mar 8, 2025Product Input Fields for WooCommerce: Arbitrary file uploadsCVE-2024-13359 · affects up to 1.12.0 · reported by WordfenceHigh 8.1
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 26, 2024Product Input Fields for WooCommerce: Directory TraversalCVE-2024-10857 · affects up to 1.9 · reported by WordfenceMedium 6.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Apr 15, 2024Product Input Fields for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-31431 · affects up to 1.7.0 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0.
Jun 6, 2023Product Input Fields for WooCommerce: Authorization bypassCVE-2020-36696 · affects up to 1.2.6 · reported by WordfenceHigh 7.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.