CVE-2020-37174
WOOF / Products Filter Professional for WooCommerce 1.2.3 Persistent XSS
- State
- Published
- Severity
- 4.8 Medium
- Published
- May 13, 2026
- Updated
- May 25, 2026
- Reserved
- Feb 10, 2026
Description
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design tab textfields. Attackers can inject JavaScript code through fields like 'Text for block toggle' and 'Custom front css styles' that executes on frontend pages when saved, affecting all site visitors.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Products Filter Professional for WooCommerceHUSKY |
|
References
- ExploitDB-48088exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: WOOF Products Filter for WooCommerce 1.2.3 Persistent XSSthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.