Vulnerabilities and security researches forwebappick-product-feed-for-woocommerce webappick-product-feed-for-woocommerce

Jun 07, 2024

CVE, Research URL: CVE-2019-1010124
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Jul 23, 2019
Research Description: WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
Affected versions: max 3.1.15.
Status: vulnerable

Mar 20, 2025

CVE, Research URL: CVE-2024-38775
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Aug 02, 2024
Research Description: Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6.
Affected versions: max 6.5.7.
Status: vulnerable

Feb 27, 2026

CVE, Research URL: CVE-2026-22461
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Jan 22, 2026
Research Description: Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CTX Feed: from n/a through <= 6.6.18.
Affected versions: max 6.6.19.
Status: vulnerable

CVE, Research URL: CVE-2025-12975
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Feb 19, 2026
Research Description: The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the woo_feed_plugin_installing() function in all versions up to, and including, 6.6.11. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install arbitrary plugins which can be leveraged to achieve remote code execution.
Affected versions: max 6.6.12.
Status: vulnerable

Apr 24, 2026

CVE, Research URL: CVE-2026-39434
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Jun 16, 2026
Research Description: Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
Affected versions: max 6.6.27.
Status: vulnerable

Aug 08, 2026

CVE, Research URL: CVE-2026-66709
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Aug 06, 2026
Research Description: Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Affected versions: max 6.6.43.
Status: vulnerable

Aug 17, 2026

CVE, Research URL: CVE-2026-73383
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Aug 18, 2026
Research Description: Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
Affected versions: max 6.6.48.
Status: vulnerable

Sep 22, 2026

CVE, Research URL: CVE-2026-15095
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Sep 22, 2026
Research Description: The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
Affected versions: max 6.6.44.
Status: vulnerable

Nov 07, 2026

CVE, Research URL: CVE-2026-87964
Home page URL: Security reports for CTX Feed – WooCommerce Product Feed Manager Plugin
Application: CTX Feed – WooCommerce Product Feed Manager Plugin
Date: Nov 06, 2026
Research Description: The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
Affected versions: max 8.0.27.
Status: vulnerable