Is HUSKY safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (1.4.7). As of 2026-11-04. 25 issues are on record for older versions; version 1.4.7 or newer fixes all of them that state a fix. Keep HUSKY on the latest version (1.4.7) and remove it if you do not use it.

Which versions of HUSKY are vulnerable?

Known issues on record (newest first): Information disclosure (1.4.6 and older, fixed in 1.4.7); Missing authorization check (1.4.6 and older, fixed in 1.4.7); Information disclosure (1.4.5 and older, fixed in 1.4.6); Reflected cross-site scripting (XSS) (1.4.3.2 and older, fixed in 1.4.4); File inclusion (1.4.4 and older, fixed in 1.4.5); Reflected cross-site scripting (XSS) (1.4.3 and older, fixed in 1.4.5). The full list with sources is on this page.

What is the latest version of HUSKY?

1.4.7, according to wordpress.org (last updated 2026-10-28). It has 80,000+ active installs.

What should I do if my HUSKY is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update woocommerce-products-filter). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · woocommerce-products-filter · data as of 2026-11-04

Is HUSKY safe? Known vulnerabilities and latest version

Latest version: 1.4.7
Last updated: 2026-10-28
Active installs: 80,000+
Known issues on record: 25
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 7.4+

HUSKY - WooCommerce Products Filter (former WOOF) – filter by categories, attributes, price and meta fields, with a built-in MCP server — by RealMag777

What to do

Update to the latest version (1.4.7). Anything older than 1.4.7 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get woocommerce-products-filter --field=version shows what you run; wp plugin update woocommerce-products-filter updates it.

Check your version

Known vulnerabilities

25 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. 2 record(s) do not state which versions are affected.

medium 6.5 CVE-2026-115947 · published 2026-10-30

Information disclosure in HUSKY (1.4.6 and older)

Affected: 1.4.6 and older
Fixed in: 1.4.7
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

NVD CVE-2026-115947 Patchstack advisory

high 7.5 CVE-2026-116401 · published 2026-10-30

Missing authorization check in HUSKY (1.4.6 and older)

Affected: 1.4.6 and older
Fixed in: 1.4.7
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

NVD CVE-2026-116401 Patchstack advisory

medium 5.3 CVE-2026-107646 · published 2026-10-16

Information disclosure in HUSKY (1.4.5 and older)

Affected: 1.4.5 and older
Fixed in: 1.4.6 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.

NVD CVE-2026-107646 Wordfence advisory plugins.svn.wordpress.org Plugin source

high 7.1 CVE-2026-95608 · published 2026-10-09

Reflected cross-site scripting (XSS) in HUSKY (1.4.3.2 and older)

Affected: 1.4.3.2 and older
Fixed in: 1.4.4
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.

NVD CVE-2026-95608 Patchstack advisory

high 8.1 CVE-2026-92969 · published 2026-09-22

File inclusion in HUSKY (1.4.4 and older)

Affected: 1.4.4 and older
Fixed in: 1.4.5 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is exploitable by unauthenticated users because the only access control is a nonce check against woof_front_nonce, which is publicly emitted into inline JavaScript on every front-end page and is therefore obtainable by any site visitor without authentication.

NVD CVE-2026-92969 Wordfence advisory Code change (fix)Plugin source

medium 6.1 CVE-2026-18562 · published 2026-09-11

Reflected cross-site scripting (XSS) in HUSKY (1.4.3 and older)

Affected: 1.4.3 and older
Fixed in: 1.4.5 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

NVD CVE-2026-18562 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2025-13110 · published 2025-12-18

Missing authorization check in HUSKY (1.3.7.3 and older)

Affected: 1.3.7.3 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.

NVD CVE-2025-13110 Wordfence advisory Code change (fix)

high 7.5 CVE-2025-11735 · published 2025-10-28

SQL injection in HUSKY (1.3.7.1 and older)

Affected: 1.3.7.1 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD CVE-2025-11735 Wordfence advisory Plugin source

high 7.5 CVE-2025-52708 · published 2025-06-20

File inclusion in HUSKY (1.3.7 and older)

Affected: 1.3.7 and older
Fixed in: 1.3.7.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.7.

NVD CVE-2025-52708 Patchstack advisory

high 7.5 CVE-2025-26890 · published 2025-03-27

File inclusion in HUSKY (1.3.6.4 and older)

Affected: 1.3.6.4 and older
Fixed in: 1.3.6.5
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-26890 Patchstack advisory

critical 9.8 CVE-2025-1661 · published 2025-03-11

File inclusion in HUSKY (1.3.6.5 and older)

Affected: 1.3.6.5 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

NVD CVE-2025-1661 Wordfence advisory Code change (fix)Plugin source

high 8.8 CVE-2023-40334 · published 2024-12-13

Missing authorization check in HUSKY (1.3.4.2 and older)

Affected: 1.3.4.2 and older
Fixed in: 1.3.4.3
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in RealMag777 HUSKY woocommerce-products-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HUSKY: from n/a through <= 1.3.4.2.

NVD CVE-2023-40334 Patchstack advisory

medium 4.3 CVE-2024-7491 · published 2024-09-25

Missing authorization check in HUSKY (1.3.6.1 and older)

Affected: 1.3.6.1 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.

NVD CVE-2024-7491 Wordfence advisory Code change (fix)

high 7.2 CVE-2024-43121 · published 2024-08-13

Privilege escalation in HUSKY (1.3.6.1 and older)

Affected: 1.3.6.1 and older
Fixed in: 1.3.6.2
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.

NVD CVE-2024-43121 Patchstack advisory

high 7.5 CVE-2024-6457 · published 2024-07-16

SQL injection in HUSKY (1.3.6 and older)

Affected: 1.3.6 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD CVE-2024-6457 Wordfence advisory Code change (fix)Plugin source

medium 6.4 CVE-2024-5039 · published 2024-05-29

Stored cross-site scripting (XSS) in HUSKY (1.3.5.3 and older)

Affected: 1.3.5.3 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-5039 Wordfence advisory Code change (fix)Plugin source

high 8.8 CVE-2024-32680 · published 2024-05-17

Remote code execution in HUSKY (1.3.5.2 and older)

Affected: 1.3.5.2 and older
Fixed in: 1.3.5.3
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUS HUSKY – Products Filter for WooCommerce (formerly WOOF) allows Using Malicious Files, Code Inclusion.This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.2.

NVD CVE-2024-32680 Patchstack advisory

high 8.8 CVE-2024-30462 · published 2024-03-29

Cross-site request forgery (CSRF) in HUSKY (1.3.5.1 and older)

Affected: 1.3.5.1 and older
Fixed in: 1.3.5.2
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.1.

NVD CVE-2024-30462 Patchstack advisory

high 7.2 CVE-2024-3061 · published 2024-03-29

File inclusion in HUSKY (1.3.5.2 and older)

Affected: 1.3.5.2 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

NVD CVE-2024-3061 Wordfence advisory Code change (fix)

high 8.8 CVE-2023-50861 · published 2024-03-15

Cross-site request forgery (CSRF) in HUSKY (1.3.4.3 and older)

Affected: 1.3.4.3 and older
Fixed in: 1.3.4.4
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

NVD CVE-2023-50861 Patchstack advisory

medium 5.4 CVE-2024-1796 · published 2024-03-15

Stored cross-site scripting (XSS) in HUSKY (1.3.5.1 and older)

Affected: 1.3.5.1 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'woof' shortcode in all versions up to, and including, 1.3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'swoof_slug'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2024-1796 Wordfence advisory Code change (fix)

high 8.8 CVE-2024-1795 · published 2024-03-15

SQL injection in HUSKY (1.3.5.2 and older)

Affected: 1.3.5.2 and older
Fixed in: 1.3.8.1 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

NVD CVE-2024-1795 Wordfence advisory Code change (fix)

critical 9.8 CVE-2023-40010 · published 2023-12-20

SQL injection in HUSKY (1.3.4.2 and older)

Affected: 1.3.4.2 and older
Fixed in: 1.3.4.3
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in realmag777 HUSKY – Products Filter for WooCommerce Professional.This issue affects HUSKY – Products Filter for WooCommerce Professional: from n/a through 1.3.4.2.

NVD CVE-2023-40010 Patchstack advisory

critical 9.8 CVE-2018-8710 · published 2018-03-14

Remote code execution in HUSKY (older than 2.2.0)

Affected: older than 2.2.0
Fixed in: unknown
Access needed (per CVSS): No login needed
Range from: NVD analysis · score by NVD

Note: the source's version range goes past the newest HUSKY release on wordpress.org (1.4.7), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any authentication. WordPress shortcode markup in the "shortcode" parameters would be evaluated. Normally unauthenticated users can't evaluate shortcodes as they are often sensitive.

NVD CVE-2018-8710 wordpress.org sec-consult.com woocommerce-filter.com

critical 9.8 CVE-2018-8711 · published 2018-03-14

File inclusion in HUSKY (older than 2.2.0)

Affected: older than 2.2.0
Fixed in: unknown
Access needed (per CVSS): No login needed
Range from: NVD analysis · score by NVD

Details from the advisory

A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable, which then could lead to a local file inclusion attack.

NVD CVE-2018-8711 wordpress.org sec-consult.com woocommerce-filter.com

Recent activity

2026-10-28 — latest release on wordpress.org (1.4.7).
2026-10-30 — Information disclosure disclosed (CVE-2026-115947), fixed in 1.4.7.
2026-10-30 — Missing authorization check disclosed (CVE-2026-116401), fixed in 1.4.7.
2026-10-16 — Information disclosure disclosed (CVE-2026-107646), fixed in 1.4.6.

Free. We check the CVE feeds every day and email you only when a new issue for HUSKY (woocommerce-products-filter) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: File inclusion (6) · Missing authorization (4) · Cross-site scripting (XSS) (4) · SQL injection (4) · Sensitive data exposure (2) · Remote code execution (2) · Cross-site request forgery (CSRF) (2) · Privilege escalation (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/woocommerce-products-filter (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/woocommerce-products-filter"><img src="https://laskyr.com/plugins/woocommerce-products-filter/badge.svg" alt="HUSKY vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is HUSKY safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (1.4.7)

What to do

Check your version

Known vulnerabilities

Information disclosure in HUSKY (1.4.6 and older)

Missing authorization check in HUSKY (1.4.6 and older)

Information disclosure in HUSKY (1.4.5 and older)

Reflected cross-site scripting (XSS) in HUSKY (1.4.3.2 and older)

File inclusion in HUSKY (1.4.4 and older)

Reflected cross-site scripting (XSS) in HUSKY (1.4.3 and older)

Missing authorization check in HUSKY (1.3.7.3 and older)

SQL injection in HUSKY (1.3.7.1 and older)

File inclusion in HUSKY (1.3.7 and older)

File inclusion in HUSKY (1.3.6.4 and older)

File inclusion in HUSKY (1.3.6.5 and older)

Missing authorization check in HUSKY (1.3.4.2 and older)

Missing authorization check in HUSKY (1.3.6.1 and older)

Privilege escalation in HUSKY (1.3.6.1 and older)

SQL injection in HUSKY (1.3.6 and older)

Stored cross-site scripting (XSS) in HUSKY (1.3.5.3 and older)

Remote code execution in HUSKY (1.3.5.2 and older)

Cross-site request forgery (CSRF) in HUSKY (1.3.5.1 and older)

File inclusion in HUSKY (1.3.5.2 and older)

Cross-site request forgery (CSRF) in HUSKY (1.3.4.3 and older)

Stored cross-site scripting (XSS) in HUSKY (1.3.5.1 and older)

SQL injection in HUSKY (1.3.5.2 and older)

SQL injection in HUSKY (1.3.4.2 and older)

Remote code execution in HUSKY (older than 2.2.0)

File inclusion in HUSKY (older than 2.2.0)

Recent activity

Get an email when HUSKY has a new vulnerability

Browse vulnerabilities

Where this data comes from