¿Es seguro Woocommerce Products Filter?

Qué hace este plugin

• Slug: woocommerce-products-filter
• 90000+ instalaciones activas

ajax filterfilterproduct filterwoocommercewoof

Estado de mantenimiento

• Última versión conocida: 1.4.1
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

24 CVEs conocidos registrados para Woocommerce Products Filter.

CVE-2020-37174

WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering XSS payloads in design tab textfields. Attackers can inject JavaScript code through fields like 'Text for block toggle' and 'Custom front css styles' that executes on frontend pages when saved, affecting all site visitors.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-13110

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-13109

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to insert or remove arbitrary saved search queries into any user's profile, including administrators.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-11735

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-52708

The HUSKY plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-26890

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-11400

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter in all versions up to, and including, 1.3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-7491

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 18 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-43121	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.6.2	Gestión incorrecta de privilegios	Alta 7,2	< 1.3.6.2	1.3.6.2	2024-08-07	✓ corregido en la última versión
CVE-2024-6457	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.6.1	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 7,5	< 1.3.6.1	1.3.6.1	2024-07-15	✓ corregido en la última versión
CVE-2024-5039	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.6	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 1.3.6	1.3.6	2024-05-28	✓ corregido en la última versión
CVE-2024-32680	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.5.3	Limitación incorrecta de una ruta a un directorio restringido (Path Traversal)	Alta 8,8	< 1.3.5.3	1.3.5.3	2024-04-17	✓ corregido en la última versión
CVE-2024-3061	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.5.3	Control incorrecto del nombre de archivo en una sentencia include/require de PHP (inclusión remota de archivos PHP / RFI)	Alta 7,2	< 1.3.5.3	1.3.5.3	2024-03-28	✓ corregido en la última versión
CVE-2024-30462	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.5.2	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 1.3.5.2	1.3.5.2	2024-03-28	✓ corregido en la última versión
CVE-2024-1796	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.5.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 1.3.5.2	1.3.5.2	2024-03-14	✓ corregido en la última versión
CVE-2024-1795	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.5.3	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Alta 8,8	< 1.3.5.3	1.3.5.3	2024-03-14	✓ corregido en la última versión
CVE-2023-50861	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.4.4	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 1.3.4.4	1.3.4.4	2023-12-22	✓ corregido en la última versión
CVE-2023-40010	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.4.3	Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL)	Crítica 9,3	< 1.3.4.3	1.3.4.3	2023-11-27	✓ corregido en la última versión
CVE-2023-40334	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.4.3	Falta de control de autorización	Media 4,3	< 1.3.4.3	1.3.4.3	2023-11-23	✓ corregido en la última versión
CVE-2022-4489	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.2	Deserialización de datos no confiables	Alta 7,2	< 1.3.2	1.3.2	2023-01-11	✓ corregido en la última versión
CVE-2021-25085	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.2.6.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 1.2.6.3	1.2.6.3	2021-12-28	✓ corregido en la última versión
CVE-2018-8710	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.2.0	Autenticación indebida	Crítica 9,8	< 1.2.0	1.2.0	2018-03-06	✓ corregido en la última versión
CVE-2018-8711	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 2.2.0	Validación incorrecta de la entrada	Crítica 9,8	< 2.2.0	2.2.0	2018-03-06	⚠ necesita actualización
—	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.1.5	—	Desconocido	< 1.1.5	1.1.5	2017-07-08	✓ corregido en la última versión
—	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.1.5	—	Desconocido	< 1.1.5	1.1.5	2017-07-08	✓ corregido en la última versión
CVE-2025-1661	HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.3.6.6	Limitación incorrecta de una ruta a un directorio restringido (Path Traversal)	Crítica 9,8	< 1.3.6.6	1.3.6.6	0000-00-00	✓ corregido en la última versión

CVE-2024-43121

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to missing option validation on the do_import_data() function in all versions up to, and including, 1.3.6.1. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-6457

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-5039

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-32680

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3061

Update the WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) plugin to the latest available version (at least 1.3.5.3). haidv35 from Viettel Cyber Security discovered and reported this Local File Inclusion vulnerability in WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could potentially allow complete database takeover depending on the configuration. This vulnerability has been fixed in version 1.3.5.3. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-30462

Update the WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) plugin to the latest available version (at least 1.3.5.2). Dhabaleshwar Das discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.3.5.2. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-1796

Update the WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) plugin to the latest available version (at least 1.3.5.2). Bassem Essam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.3.5.2. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-1795

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-50861

Update the WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) plugin to the latest available version (at least 1.3.4.4). Mika discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.3.4.4. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-40010

The HUSKY – Products Filter for WooCommerce (formerly WOOF) plugin for WordPress is vulnerable to generic SQL Injection via search terms in versions up to, and including, 1.3.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-40334

Update the WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) plugin to the latest available version (at least 1.3.4.3). thiennv discovered and reported this Broken Access Control vulnerability in WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 1.3.4.3.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-4489

Update the WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) plugin to the latest available version (at least 1.3.2). thinhnguyen1337 discovered and reported this PHP Object Injection vulnerability in WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin. This could allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more. This could allow a malicious actor to take-over a website. This vulnerability has been fixed in version 1.3.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-25085

The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2018-8710

A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2018-8711

A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.1.5

WordPress WooCommerce Products Filter is prone to An Arbitrary File Upload Vulnerability. The file /lib/simple-ajax-uploader/action.php doesn't do any validation who can access the upload functionality. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter] < 1.1.5

WordPress WooCommerce Products Filter plugin is prone to Authenticated Persistent Cross-Site Scripting (XSS) Vulnerability. The settingsa re saved without sanitization and “default_overlay_skin_word” is shown on the front-end pages without escaping it. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2025-1661

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Woocommerce Products Filter actualizado — 1.4.1 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Filter Everything — WordPress & WooCommerce Filters — 50000+ instalaciones activas — 92/100 (145) — PHP máx. 8.4
• Search & Filter — 50000+ instalaciones activas — 90/100 (175) — PHP máx. 8.4
• Allow HTML in Category Descriptions — 8000+ instalaciones activas — 100/100 (41) — PHP máx. 8.4
• Category AJAX Filter — Advanced Filter for Posts & Custom Post Types — 6000+ instalaciones activas — 98/100 (152)
• Jetpack Search — 5000+ instalaciones activas — 90/100 (10)