WebAppick vulnerabilities

Products

• CTX Feed 5
• Challan 2
• woocommerce product feed 2

Latest WebAppick CVEs

Newest publication first

1. CVE-2026-39765 WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

   Published 2026-10-06

   High·CVSS 7.2

   Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

2. CVE-2026-73383 WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability

   Published 2026-08-18

   Medium·CVSS 4.9

   Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

3. CVE-2026-66709 WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability

   Published 2026-08-06

   Critical·CVSS 9.1

   Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

4. CVE-2026-39434 WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability

   Published 2026-06-15

   High·CVSS 7.2

   Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

5. CVE-2026-22461 WordPress CTX Feed plugin <= 6.6.18 - Broken Access Control vulnerability

   Published 2026-01-22

   Medium·CVSS 5.3

   Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CTX Feed: from n/a through <= 6.6.18.

6. CVE-2025-47462 WordPress Challan plugin <= 3.7.58 - CSRF to Privilege Escalation vulnerability

   Published 2025-05-07

   High·CVSS 8.8

   Cross-Site Request Forgery (CSRF) vulnerability in WebAppick Challan webappick-pdf-invoice-for-woocommerce allows Privilege Escalation.This issue affects Challan: from n/a through <= 3.7.58.

7. CVE-2024-38775 WordPress CTX Feed plugin <= 6.5.6 - Arbitrary Options Update vulnerability

   Published 2024-08-01

   High·CVSS 7.2

   Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6.

8. CVE-2019-1010124 WooCommerce Product Feed for Google, Facebook, eBay and Many More <= 3.1.14 - Reflected Cross-Site Scripting

   Published 2019-07-23

   Medium·CVSS 5.4 Public exploit

   WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.