{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2021-4337", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2023-06-06T12:20:33.347Z", "datePublished": "2023-06-07T12:43:07.139Z", "dateUpdated": "2026-04-08T16:33:21.807Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:21.807Z" }, "affected": [ { "vendor": "XforWooCommerce", "product": "Package Quantity Discount", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.2.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Price Commander for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Bulk Add to Cart for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Floating Cart for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Comment and Review Spam Control for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.5.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Add Product Tabs for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.5.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Autopilot SEO for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.6.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "XforWooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.7.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Product Loops for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "1.7.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Live Search for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "2.1.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Share, Print and PDF Products for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "2.8.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Improved Sale Badges for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "4.4.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Live Product Editor for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "4.7.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Warranties and Returns for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "5.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Improved Product Options for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "5.3.0", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "XforWooCommerce", "product": "Product Filter for WooCommerce", "versions": [ { "version": "0", "status": "affected", "lessThan": "8.2.0", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0." } ], "title": "Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization", "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve" }, { "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/" }, { "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/" } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE" } ] } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" } } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jerome Bruandet" } ], "timeline": [ { "time": "2021-09-07T00:00:00.000Z", "lang": "en", "value": "Disclosed" } ] }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:23:10.474Z" }, "title": "CVE Program Container", "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=cve", "tags": [ "x_transferred" ] }, { "url": "https://blog.nintechnet.com/16-woocommerce-product-add-ons-plugins-fixed-vulnerabilities/", "tags": [ "x_transferred" ] }, { "url": "https://xforwoocommerce.com/blog/change-log/xforwoocommerce-1-7-0/", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-12-23T16:00:34.189441Z", "id": "CVE-2021-4337", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-23T16:20:14.700Z" } } ] } }