Additional Product Fields For Woocommerce Vulnerabilities

The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to 1.2.176. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.2.176

Fixed in:

1.2.176

Disclosed:

Aug 20, 2026

CVE-2026-19728 on NVD →

The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.167. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.2.167

Fixed in:

1.2.168

Disclosed:

Jul 8, 2026

CVE-2026-57390 on NVD →

[en] The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input sanitization and output escaping. This makes...

Affected:

up to 1.2.134

Fixed in:

1.2.134

Disclosed:

Oct 24, 2024

CVE-2024-9214 on NVD →

The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'RednaoSerializedFields' parameter during the creation of a signature file in all versions up to, and including, 1.2.133 due to insufficient input sanitization and output escaping. This makes it p...

CVSS:

6.1

Affected:

up to 1.2.133

Fixed in:

1.2.134

Disclosed:

Oct 23, 2024

CVE-2024-9214 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in RedNao Extra Product Options Builder for WooCommerce.This issue affects Extra Product Options Builder for WooCommerce: from n/a through 1.2.104.

Affected:

up to 1.2.105

Fixed in:

1.2.105

Disclosed:

Apr 15, 2024

CVE-2024-31940 on NVD →

The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.104. This is due to missing or incorrect nonce validation on the DontShowAgain() function. This makes it possible for unauthenticated attackers to dismiss notices via...

CVSS:

4.3

Affected:

up to 1.2.104

Fixed in:

1.2.105

Disclosed:

Apr 10, 2024

CVE-2024-31940 on NVD →