PickPlugins Product Designer for WooCommerce

PickPlugins Product Designer for WooCommerce has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 3 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2024 was the busiest year with 3 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

4 independent researchers contributed these findings, one record each.

01234567891005.04.2024Today05.04.20249.8Product Designer <= 1.0.32 - Unauthenticated PHP Object Injection CVSS 9.8 · 05.04.202408.07.20245.3Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion CVSS 5.3 · 08.07.202420.11.20246.4Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVSS 6.4 · 20.11.202415.10.20265.3Product Designer <= 1.0.40 - Missing Authorization CVSS 5.3 · 15.10.2026

Strategic Overview

Avg CVSSMedium
6.7/ 10
Patch Coverage75%
Open

1

Fixed

3

Get automatic notifications for all PickPlugins Product Designer for WooCommerce vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-87844

Product Designer <= 1.0.40 - Missing Authorization

Read the full analysis

Vulnerability Records

4 records
Showing 1–4 of 4 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C