Studio Wombat vulnerabilities

Products

• Advanced Product Fields Extended for WooCommerce 1
• Shoppable Images 1

Latest Studio Wombat CVEs

Newest publication first

1. CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

   Published 2026-09-10

   High·CVSS 8.6 EPSS 0.53%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.

2. CVE-2023-25698 WordPress Shoppable Images Lite Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-05-18

   High·CVSS 8.8 EPSS 0.25%

   Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.