WC Fields Factory
by WordPress
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-93508 | Hig | 0.53 | 8.1 | 0.00 | Sep 23, 2026 | The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce… | ||
| CVE-2023-0277 | Hig | 0.47 | 7.2 | 0.01 | Apr 17, 2023 | The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin | ||
| CVE-2026-39727 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions. | ||
| CVE-2026-93507 | Low | 0.21 | 3.3 | 0.00 | Sep 23, 2026 | The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft… |
- risk 0.53cvss 8.1epss 0.00
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce…
- risk 0.47cvss 7.2epss 0.01
The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
- risk 0.21cvss 3.3epss 0.00
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft…