Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-107646

HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Realmag777 Wordpress-extensions
Products
Husky – Products Filter For Woocommerce Professional Husky
CVE-2026-15244

HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Husky