3D Product configurator for WooCommerce
3D Product configurator for WooCommerce has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Path Traversal, behind 1 of the records (50%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
Every one of the 2 issues recorded for 3D Product configurator for WooCommerce has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. 3D Product configurator for WooCommerce is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.10.
CVE-2026-1038893D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
Read the full analysisVulnerability Records
3D Product configurator for WooCommerce
Author
Expivi
This plugin allows your WooCommerce-powered webshop to display your products in a 3D environment. It integrates with the Expivi platform, so you will need to register an account on Expivi.com. Not sure if Expivi is a good fit for your products? Book a free 15-minute demo and we’ll show you. You will need to use the Expivi online configurator to create and configure your products. Afterwards, you can link your WooCommerce products to your Expivi products.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C