PluginUs.Net vulnerabilities

Products

• MDTF 4
• Active Products Tables for WooCommerce 2
• FOX 2
• BEAR 1
• HUSKY 1
• TableOn 1
• WOLF 1

Latest PluginUs.Net CVEs

Newest publication first

1. CVE-2026-123461 WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3

   Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.6.

2. CVE-2026-123183 WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a thro...

3. CVE-2026-115611 WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-29

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7.

4. CVE-2026-108175 WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-15

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.

5. CVE-2026-108151 WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability

   Published 2026-10-14

   Medium·CVSS 5.3

   Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.

6. CVE-2026-108179 WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability

   Published 2026-10-13

   High·CVSS 7.6

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.

7. CVE-2026-108489 WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability

   Published 2026-10-13

   Medium·CVSS 5.3

   Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.

8. CVE-2026-108174 WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability

   Published 2026-10-13

   Medium·CVSS 5.3

   Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.

9. CVE-2026-95608 WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-09

   High·CVSS 7.1 EPSS 0.18%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.

10. CVE-2026-54845 WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability

    Published 2026-06-25

    High·CVSS 8.1

    Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

11. CVE-2026-54843 WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability

    Published 2026-06-25

    Critical·CVSS 9.3

    Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

12. CVE-2026-27415 WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-05-07

    Medium·CVSS 4.3

    Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.