Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.

CVE-2026-108151 is a medium severity vulnerability in the PluginUs.Net MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin that allows code injection due to improper control of code generation. It affects versions from 0 up to but not including 1.4.0. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.

Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.

Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.

CVE-2026-95608 is a high-severity reflected cross-site scripting (XSS) vulnerability in the PluginUs.Net HUSKY woocommerce-products-filter plugin. It affects versions from initial releases up to 1.4.3.2. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating significant impact on confidentiality, integrity, and availability with network attack vector and low attack complexity. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5.