Product Vendors

Product Vendors has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2023; all 9 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2023 was the busiest year with 5 disclosures.

The most common weakness is SQL Injection, behind 3 of the records (33%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Cross-Site Scripting.

Every one of the 9 issues recorded for Product Vendors has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (5) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Product Vendors vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

WooCommerce Products Vendor <= 2.1.65 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

9 records


2023-12-29 00:00	WooCommerce Product Vendors <= 2.2.2 - Missing Authorization Product Vendors <= 2.2.2	`CVE-2023-52186`	5.3 Medium	Rafie Muhammad	Yes
2023-12-27 00:00	WooCommerce Product Vendors <= 2.2.1 - Missing Authorization Product Vendors <= 2.2.1	`CVE-2023-51494`	5.3 Medium	Rafie Muhammad	Yes
2023-06-19 00:00	WooCommerce Product Vendors <= 2.1.78 - Authenticated (Shop manager+) SQL Injection Product Vendors <= 2.1.78	`CVE-2023-35879`	6.6 Medium	Rafie Muhammad	Yes
2023-05-24 00:00	WooCommerce Product Vendors <= 2.1.76 - Reflected Cross-Site Scripting Product Vendors <= 2.1.76	`CVE-2023-33332`	6.1 Medium	Rafie Muhammad	Yes
2023-05-24 00:00	WooCommerce Product Vendors <= 2.1.76 - Authenticated (Vendor admin+) SQL Injection Product Vendors <= 2.1.76	`CVE-2023-33331`	7.2 High	Rafie Muhammad	Yes
2022-10-04 00:00	WooCommerce Products Vendor <= 2.1.65 - Insecure Direct Object Reference to Note Creation Product Vendors <= 2.1.65	`N/A`	4.3 Medium	foobar7	Yes
2022-10-04 00:00	WooCommerce Products Vendor <= 2.1.68 - Insecure Direct Object Reference to Vendor Commission Percentage Update Product Vendors <= 2.1.68	`N/A`	4.3 Medium	foobar7	Yes
2022-10-04 00:00	WooCommerce Products Vendor <= 2.1.65 - Unauthenticated SQL Injection Product Vendors <= 2.1.65	`N/A`	9.8 Critical	foobar7	Yes
2017-08-22 00:00	Product Vendors <= 2.0.35 - Reflected Cross Site Scripting Product Vendors < 2.0.36	`CVE-2017-20193`	4.7 Medium	Ram	Yes

Showing 1–9 of 9 reports