Plugins · woo-product-feed-pro · data as of 2026-11-04
Is Product Feed PRO for WooCommerce by AdTribes safe? Known vulnerabilities and latest version
- Latest version
- 13.5.8
- Last updated
- 2026-10-01
- Active installs
- 80,000+
- Known issues on record
- 7
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4
Most popular WooCommerce product feed plugin supporting Google shopping feed, meta/facebook feed, bing product feed & more. — by Josh Kohlbach
What to do
- Update to the latest version (13.5.8). Anything older than 13.5.8 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get woo-product-feed-pro --field=version shows what you run; wp plugin update woo-product-feed-pro updates it.
Check your version
Known vulnerabilities
7 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
high 7.2 CVE-2026-103349 · published 2026-10-05
PHP object injection in Product Feed PRO for WooCommerce by AdTribes (13.5.7 and older)
- Affected
- 13.5.7 and older
- Fixed in
- 13.5.8 *
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- advisory text · score by Patchstack
Details from the advisory
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
high 7.5 CVE-2026-16611 · published 2026-08-15
Information disclosure in Product Feed PRO for WooCommerce by AdTribes (older than 13.5.7)
- Affected
- older than 13.5.7
- Fixed in
- 13.5.7
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.
high 8.8 CVE-2026-3499 · published 2026-04-08
Cross-site request forgery (CSRF) in Product Feed PRO for WooCommerce by AdTribes (13.4.6 to 13.5.2.1)
- Affected
- 13.4.6 to 13.5.2.1
- Fixed in
- 13.5.2.2 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 through 13.5.2.1. This is due to missing or incorrect nonce validation on the ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed functions. This makes it possible for unauthenticated attackers to trigger feed migration, clear custom-attribute transient caches, rewrite feed file URLs to lowercase, toggle legacy filter and rule settings, and delete duplicated feed posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
medium 6.5 CVE-2026-32443 · published 2026-03-13
Cross-site request forgery (CSRF) in Product Feed PRO for WooCommerce by AdTribes (13.5.2 and older)
- Affected
- 13.5.2 and older
- Fixed in
- 13.5.2.1 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- advisory text · score by Patchstack
Details from the advisory
Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.
medium 5.3 CVE-2024-32513 · published 2024-04-17
Information disclosure in Product Feed PRO for WooCommerce by AdTribes (13.3.1 and older)
- Affected
- 13.3.1 and older
- Fixed in
- 13.3.2 *
- Access needed (per CVSS)
- No login needed
- Range from
- advisory text · score by Patchstack
Details from the advisory
Insertion of Sensitive Information into Log File vulnerability in AdTribes.Io Product Feed PRO for WooCommerce.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.3.1.
high 7.1 CVE-2024-24800 · published 2024-03-27
Reflected cross-site scripting (XSS) in Product Feed PRO for WooCommerce by AdTribes (13.2.5 and older)
- Affected
- 13.2.5 and older
- Fixed in
- 13.2.6 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- advisory text · score by Patchstack
Details from the advisory
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdTribes.Io Product Feed PRO for WooCommerce allows Reflected XSS.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.2.5.
high 8.8 CVE-2022-46793 · published 2023-04-06
Cross-site request forgery (CSRF) in Product Feed PRO for WooCommerce by AdTribes (12.4.4 and older)
- Affected
- 12.4.4 and older
- Fixed in
- 12.4.5 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- advisory text · score by NVD
Details from the advisory
Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.
Recent activity
- 2026-10-01 — latest release on wordpress.org (13.5.8).
- 2026-10-05 — PHP object injection disclosed (CVE-2026-103349), fixed in 13.5.8.
- 2026-08-15 — Information disclosure disclosed (CVE-2026-16611), fixed in 13.5.7.
- 2026-04-08 — Cross-site request forgery (CSRF) disclosed (CVE-2026-3499), fixed in 13.5.2.2.
Get an email when Product Feed PRO for WooCommerce by AdTribes has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Product Feed PRO for WooCommerce by AdTribes (woo-product-feed-pro) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
- Published this week
- Unpatched in the latest version
- By type of vulnerability
- Plugins by Josh Kohlbach (5 tracked)
Types found in this plugin: Cross-site request forgery (CSRF) (3) · Sensitive data exposure (2) · PHP object injection (1) · Cross-site scripting (XSS) (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/woo-product-feed-pro (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/woo-product-feed-pro"><img src="https://laskyr.com/plugins/woo-product-feed-pro/badge.svg" alt="Product Feed PRO for WooCommerce by AdTribes vulnerability status"></a>