Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · webappick-product-feed-for-woocommerce
CTX Feed
7 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 22, 2026Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels: Directory TraversalCVE-2026-15095 · affects up to 6.6.43 · reported by WordfenceMedium 4.9
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 18, 2026Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.CVE-2026-73383 · affects up to 6.6.47 · reported by PatchstackMedium 4.9
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
Aug 6, 2026Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.CVE-2026-66709 · affects up to 6.6.42 · reported by PatchstackCritical 9.1
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Jun 15, 2026Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.CVE-2026-39434 · affects up to 6.6.26 · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
Feb 19, 2026CTX Feed – WooCommerce Product Feed Manager: Unauthorized arbitrary plugin installationCVE-2025-12975 · affects up to 6.6.11 · reported by WordfenceHigh 7.2
The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the woo_feed_plugin_installing() function in all versions up to, and including, 6.6.11. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install arbitrary plugins which can be leveraged to achieve remote code execution.
Jan 22, 2026CTX Feed: Missing AuthorizationCVE-2026-22461 · affects up to 6.6.18 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CTX Feed: from n/a through <= 6.6.18.
Aug 1, 2024CTX Feed: Improper Privilege ManagementCVE-2024-38775 · affects up to 6.5.6 · reported by PatchstackHigh 7.2
Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.