pickplugins Product Designer vulnerabilities

Latest pickplugins Product Designer CVEs

Newest publication first

1. CVE-2024-38726 WordPress Product Designer plugin <= 1.0.33 - Arbitrary Content Deletion vulnerability

   Published 2024-11-01

   High·CVSS 7.5 EPSS 0.48%

   Missing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Designer: from n/a through 1.0.33.

2. CVE-2024-3608 Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

   Published 2024-07-09

   Medium·CVSS 5.3 EPSS 0.56%

   The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to de...

3. CVE-2024-31277 WordPress Product Designer plugin <= 1.0.32 - PHP Object Injection vulnerability

   Published 2024-04-07

   High·CVSS 8.7 EPSS 0.47%

   Deserialization of Untrusted Data vulnerability in PickPlugins Product Designer.This issue affects Product Designer: from n/a through 1.0.32.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.