Threat database

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3		CVE-2026-116107Datafeedr Product Sets Plugin · Missing Authorization Medium5.32026-10-26CVE Database V5CVE-2026-116107 CVE-2026-116107 is a medium severity vulnerability in the Datafeedr Product Sets Plugin for WordPress, affecting versions 1.3.0 through 1.3.19. It involves missing authorization in the AJAX handler function dfrps_ajax_delete_saved_search, allowing remote attackers to perform unauthorized actions. Public exploit code is available. Upgrading to version 1.3.25 resolves the issue. Vulnerability	CVE Database V5	2026-10-26
Medium	5.4	EPSS 0.2%	CVE-2025-24647WooCommerce Cloak Affiliate Links (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium5.4EPSS 0.2%2025-01-24CVE Database V5CVE-2025-24647 Cross-Site Request Forgery (CSRF) vulnerability in datafeedr WooCommerce Cloak Affiliate Links woocommerce-cloak-affiliate-links allows Cross Site Request Forgery.This issue affects WooCommerce Cloak Affiliate Links: from n/a through <= 1.0.35. EPSS 0.2%Vulnerability datafeedr	CVE Database V5	2025-01-24
High	7.5	EPSS 0.7%	CVE-2024-1308Cloak Affiliate Links for WooCommerce (WordPress plugin) · Improper Access Control High7.5EPSS 0.7%2024-04-09CVE Database V5CVE-2024-1308 The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links. EPSS 0.7%Vulnerability datafeedrcom CWE-284	CVE Database V5	2024-04-09

Page 1 of 1